The August 2025 Advisory Is About Routers. Traveling Staff Still Carry Phones.
The advisory tells network defenders to hunt on backbone routers. The person in the departure lounge still has a phone full of work.
On August 27, 2025, CISA, NSA, FBI, and international partners released a joint advisory on PRC state-sponsored actors maintaining long-term access in telecommunications, government, transportation, lodging, and defense networks. CISA said the activity overlaps industry reporting on Salt Typhoon and several other names, and that the agencies would talk about behavior rather than adopt one commercial label. The actors were exploiting vulnerabilities in provider-edge and customer-edge routers, often modifying firmware and configurations.
That is a network-defender document. It is also a reason to reread the December 2024 mobile guidance before the next trip. CISA already told highly targeted people to assume mobile communications could be intercepted. A traveling employee is not automatically that person. A traveling employee with a work phone on hotel Wi-Fi is still carrying mail, files, and an authenticator.
What you can actually assign to a traveler
- A managed phone or laptop, encrypted, enrolled, and tested for remote wipe. Unmanaged personal hardware does not get the VPN.
- A rule for loss: call this number, then the device is locked or wiped. Do not wait until they land.
- App permissions reduced to what the trip requires. Location on for a maps app is not a reason for every other app to have it.
- No local exports of customer lists "just in case the VPN is slow."
DriveStrike is the wipe, lock, and locate piece for devices you enroll. Router firmware is the advisory's problem, and it is not solved by an endpoint agent. Keep those sentences separate when you brief. The December guidance is summarized in the earlier mobile note.
Before the next offsite, put a pilot group on DriveStrike or ask Spearstone to review the travel standard.
Keep reading
- The Devices That Leave the Building Are the Ones That Need a Wipe Path
- Holiday Travel Is When Company Data Rides in a Backpack
Questions worth answering directly
What did the August 27, 2025 alert ask defenders to do?
Hunt for the activity and apply the mitigations in the advisory, especially organizations in the sectors named: telecommunications, government, transportation, lodging, and defense. The alert highlights provider-edge and customer-edge routers.
Does the advisory say every business traveler is being intercepted?
No. It describes targeting of network infrastructure and long-term access in specific sectors. Device rules for travelers are a separate, still necessary control.