Salt Typhoon: Telecom Carrier Espionage

A nation-state actor exploited a pre-authentication vulnerability in the IOS XE WebUI of an Axiom Carrier Services edge router, planted a flash-resident implant, and configured ERSPAN mirroring on the core switch to intercept subscriber traffic. Reconstruct the compromise from router syslog, perimeter firewall, and a PCAP capture spanning the initial exploit through credential exfiltration.