Topic starter
16/01/2026 4:50 pm
TL;DR: Salt Typhoon’s JumbledPath campaign shows how stolen credentials, legacy remote access protocols, and edge devices can still be combined to reach telecom infrastructure, according to Beyond Identity. The lesson is that identity controls, device access, and protocol hardening must be treated as one NHI governance problem, not separate hygiene tasks.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “Salt Typhoon: JumbledPath Malware Targeting US Telecom Providers”.
Key questions
Q: What breaks when stolen credentials are still accepted by legacy network devices?
A: The control that breaks is the assumption that a password only grants limited, reviewable access.
Q: Why do legacy protocols like TACACS, RADIUS, and SNMP increase telecom breach risk?
A: They increase risk because they often sit on trusted management paths and can expose configuration, authentication, or administrative data if they are weakly protected.
Q: How can security teams tell whether edge devices are failing as identity controls?
A: Look for administrative access that bypasses federation, repeated use of the same credentials across devices, and management traffic that is trusted because it is internal rather than because it is strongly authenticated.
Practitioner guidance
- Replace password-based remote access with phishing-resistant authentication Use device-bound passkeys or equivalent phishing-resistant methods for network-device and remote-access accounts so a stolen password cannot open administrative paths.
- Federate device administration where vendors support it Move administrative access for networking gear into SSO-backed federation so audit trails, policy enforcement, and account lifecycle controls sit in one identity plane.
- Restrict management access to known administrative paths Segment and allow-list access to network devices so jump-hosts, source IPs, and control-plane ports are explicitly governed rather than implicitly trusted.
Bottom line: Salt Typhoon’s JumbledPath campaign shows that stolen credentials and legacy management protocols can still defeat weakly governed network-access controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:57 pm
Legacy protocol trust is the real attack surface here: Salt Typhoon succeeded because older authentication and management paths still accepted credentials that should not have been enough on their own. SNMP, TACACS, RADIUS, and jump-host patterns created a trust chain that converted one login into broader administrative reach. The implication is that NHI governance must extend beyond credential strength into protocol trust and device trust.
A question worth separating out:
Q: Should organisations prioritise federation or protocol hardening first for network devices?
A: If devices still accept passwords on exposed management paths, protocol hardening and phishing-resistant authentication should be tackled together. Federation helps with auditability, but it does not fix a control plane that still trusts old protocols. The right priority is to remove the easiest login path while shrinking the management surface at the same time.
👉 Read our full editorial: Salt Typhoon’s JumbledPath shows legacy protocols still enable NHI abuse