Loading threat actor…
Salt Typhoon is a People's Republic of China-linked, state-sponsored cyberespionage actor targeting telecommunications providers, government organizations, and technology companies worldwide. Its operations emphasize persistent access to communications infrastructure, intelligence collection, and surveillance of high-value government and political figures. Documented compromises include at least nine U.S. telecommunications providers, with related activity identified in Canada and New Zealand. Operators have stolen customer call records and collected selected individuals' private communications. Public tracking names associated with overlapping activity include GhostEmperor, Earth Estries, OPERATOR PANDA, RedMike, UNC5807, and UNC2286. These names are not consistently treated as exact synonyms across tracking organizations. Earth Estries activity includes government and technology targeting in the Philippines, Taiwan, Malaysia, South Africa, Germany, and the United States. The actor exploits known vulnerabilities in internet-facing applications and network appliances, including Cisco networking equipment, Microsoft Exchange, and security products. Documented exploitation includes CVE-2018-0171 and CVE-2023-20198. Operators modify network-device configurations, implant malicious code, and establish GRE tunnels to collect and extract traffic. Some telecommunications intrusions persisted for more than three years. Associated operations use compromised administrative accounts, legitimate administration utilities, DLL sideloading, encrypted command-and-control communications, and custom backdoors to support stealthy persistence and lateral movement. Malware associated with Salt Typhoon includes GhostSpider, SnappyBee, and Masol. Earth Estries operations additionally employ Zingdoor, HemiGate, and TrillClient for remote access, keylogging, browser-credential collection, and data theft. Operational concealment includes obfuscation, PowerShell downgrade attacks, abuse of legitimate online services, and periodic replacement of backdoors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
30 malware families attributed to this actor across reporting.
25 additional families tracked in Mallory.
26 CVEs this actor has used in observed campaigns. 26 of them exploited in the wild.
According to ESET telemetry, FamousSparrow started to exploit the vulnerabilities the day following Microsoft’s release of a patch for the problem. In FamousSparrow’s case, it used the bug to deploy SparrowDoor.
Cyber actors are installing an implant dubbed ‘BADCANDY’ on Cisco IOS XE devices that are vulnerable to CVE-2023-20198. ASD is aware of ongoing exploitation.
Static Tundra has been exploiting CVE-2018-0171, a CVSS 9.8 Cisco Smart Install vulnerability, to compromise unpatched network devices worldwide for intelligence gathering. The content also reports that Salt Typhoon leveraged this vulnerability against major U.S. telecommunications companies.
CVE-2024-21887 is listed as an 'Ivanti Connect Secure and Ivanti Policy Secure Command Injection Vulnerability' exploited by Salt Typhoon.
The process command line contained the MSExchangePowerShellAppPool argument, indicating that the attacker exploited the Exchange server via the ProxyNotShell exploit chain... ProxyNotShell (CVE-2022-41040, CVE-2022-41082) is a related exploit chain disclosed in 2022. Both allow unauthenticated attackers to execute code on unpatched Exchange servers.
21 more CVEs tied to this actor tracked in Mallory.
404 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as a background example of the scale of Chinese cyber operations. The group compromised at least nine U.S. telecommunications carriers and reached more than 200 organizations across approximately 80 countries; the other countries are not identified.
Associated with breaches of U.S. and global telecommunications networks. Its operations informed the Taiwan war-game scenario; the article does not attribute an actual attack on Taiwan to this actor.
A Chinese hacking campaign that breached telecommunications networks in the United States and elsewhere. Its operations informed the Taiwan war game's communications-disruption scenario, although the exercise packets did not name it directly.
Chinese state-sponsored group described as compromising organizations worldwide, including US telecommunications carriers, and maintaining prolonged access to collect communications data. The article presents this activity as an example of harvesting encrypted data for potential future quantum-enabled decryption.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.