Salt Typhoon

Salt Typhoon is a China-linked state-affiliated cyber espionage threat actor active since at least 2019 and focused primarily on long-term intelligence collection against telecommunications infrastructure. The group is widely tracked under multiple aliases including GhostEmperor, Earth Estries, FamousSparrow, RedMike, Operator Panda, UNC2286, and UNC5807. Public reporting also reflects naming overlap and occasional ambiguity with labels such as KELP and Salt Typhoon-related variants, but Salt Typhoon is the most widely recognized name. The actor is notable for compromising major telecommunications providers and maintaining covert access for extended periods, in some cases for years. Its operations have targeted core telecom environments, including systems associated with lawful-intercept capabilities, with the apparent objectives of intercepting communications, mapping internal networks, collecting configuration and routing data, and preserving strategic access for future intelligence collection or potential disruptive use. Victimology has centered on large telecom operators and related critical communications infrastructure, with reporting also linking the group to intrusions affecting government-connected and defense-relevant environments through telecom access. Salt Typhoon’s tradecraft is distinguished by deep abuse of network infrastructure rather than reliance on conventional endpoint malware. Reported initial access methods include use of valid accounts and, in at least one confirmed case, exploitation of CVE-2018-0171 in Cisco Smart Install. The group has been associated with credential theft and manipulation of network authentication and authorization infrastructure, creation of additional accounts, modification of access controls, and establishment of multiple redundant access paths. Post-compromise activity emphasizes living-off-the-land techniques on routers, switches, and adjacent systems. Observed behaviors include command execution through network device command-line interfaces, activation of Cisco Guest Shell to obtain Linux-level access on supported devices, enabling persistent remote administration channels, collection of running configurations and other device-resident data, use of compromised network devices as pivot points, and traffic duplication or mirroring to support collection. The actor has also used tunneling mechanisms such as GRE and IPsec to move traffic and maintain covert command-and-control paths across compromised infrastructure. Where server-side tooling has been observed, reporting has linked Salt Typhoon to malware and frameworks including GhostSpider, Demodex, SnappyBee, HemiGate, and Cobalt Strike, as well as DLL sideloading through legitimate software. On network devices, the group has been associated with specialized utilities for remote packet capture and collection across chains of compromised devices. Even so, the actor is especially notable for minimizing traditional malware deployment and instead exploiting legitimate device functionality, administrative access, and native management features to reduce detection opportunities. Operationally, Salt Typhoon aligns with broader Chinese intrusion patterns that prioritize stealth, persistence, credential access, discovery, and defense evasion. Comparative ATT&CK-based analyses place the group within a cluster of Chinese espionage actors that share substantial post-compromise behavioral overlap, particularly around valid-account abuse, tool acquisition, network discovery, and indicator removal, although Salt Typhoon is often underrepresented in public datasets because of limited disclosure relative to its apparent capability. Overall, Salt Typhoon represents a high-capability Chinese espionage actor specializing in covert, long-duration compromise of telecommunications and network infrastructure. Its emphasis on infrastructure-level access, lawful-intercept adjacency, credential abuse, and native device functionality makes it particularly significant for telecom operators, governments, and organizations dependent on carrier networks for sensitive communications.