Insikt Group Briefing - February 13th 2025

Overview

This document provides an overview of Recorded Future’s Insikt Group intelligence reporting and analysis published during the 2025 Munich Security Conference. Links to the full reports are included.

Subject

Adversarial Actors — China, Russia, Iran, and North Korea — are adapting to and exploiting Western openness and fragmentation through hostile cyber, economic, and military actions.

Reporting and Analysis

1. The Risk of a Taiwan Invasion Is Rising Fast
2. Russian Influence Operations Target German Elections
3. RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers
4. Inside the Scam: North Koreaʼs IT Worker Threat

The Risk of a Taiwan Invasion Is Rising Fast

Click here to read the report.

Key Takeaways

• An invasion is currently unlikely, but political, economic, and military trends suggest that by 2027, China’s leadership will be able to consider an invasion while minimizing the costs.
• A protracted war over Taiwan would have profound consequences for the global economy, disrupting critical shipping lanes and devastating technology supply chains in East Asia.
• Bottom Line: Businesses should begin investing in contingency plans to protect and diversify their operations in case China invades or undertakes other significant military action against Taiwan in the coming decade.

Russian Influence Operations Target German Elections

Click here to read the report.

Key Takeaways

• The forthcoming German elections are a target of Russian influence operations. As of mid-February, these operations have not meaningfully altered voter behavior or public opinion.
• These operations aim to inflame German sociopolitical divisions, spread manipulated content, foster anti-US and EU sentiment, and weaken NATO unity in line with Kremlin objectives.
• Bottom Line: These influence operations have had limited voter impact, but their persistence and evolving tactics elevate the threat of a breakout influence event.

RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers

Click here to read the report.

Click here to read the Wired article.

Key Takeaways

• Insikt group observed RedMike exploiting privilege escalation vulnerabilities CVE-2023-20273 and CVE-2023-20198 to compromise unpatched Cisco network devices running Cisco IOS XE software.
• RedMike compromised devices of a US-based affiliate of a UK telecommunications company, a South African telecommunications company, and attempted to exploit over 1,000 Cisco devices between December 2024 and January 2025.
• Bottom Line: Despite media coverage and US sanctions, RedMike (Salt Typhoon) continues to target and penetrate telecommunications providers globally, including in the US.

Inside the Scam: North Koreaʼs IT Worker Threat

Click here to read the report.

Key Takeaways

• PurpleBravo has targeted at least seven entities, three of which are in the cryptocurrency sector, including a market-making firm, an online casino, and a blockchain software company.
• PurpleBravo was active on at least three hiring websites, Telegram, and GitHub, regularly posting job advertisements and updating repositories.
• Insikt Group identified at least seven suspected North Korea-linked front companies operating in China spoofing legitimate IT firms in China, India, Pakistan, Ukraine, and the United States.
• Bottom Line: North Korea’s malign cyber activity continues at scale.