Volt Typhoon

Unit 42 links CL-STA-1132 to Chinese state-sponsored actors exploiting CVE-2026-0300 for espionage. IOCs and attack timeline revealed after a month of active exploitation.

All new overseas-manufactured routers prohibited from U.S. market after Volt Typhoon and Salt Typhoon exploited compromised devices. Existing routers unaffected.