the most advanced hack i've ever seen

A breakdown of a sophisticated attack chain attributed to Salt Typhoon (UAT8616), a Chinese threat actor. The attack exploited a vulnerability in Cisco SDWAN's peering system to join a corporate network as a fake branch node. From there, attackers performed a firmware downgrade to reintroduce a 2022 CVE (path traversal in the Cisco SDWAN CLI), then leveraged it to read the confd IPC secret and escalate privileges to root across every branch of the target company. Defenders are advised to upgrade firmware, monitor for unrecognized peers joining the control plane, and watch for crafted usernames containing path traversal strings in authentication logs.