Salt Typhoon Espionage Attack on European Telecommunications Provider

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

Salt Typhoon

Observables

3 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Securitysenses BlogNews · Oct 30, 2025

Episode 1: Typhoon Season with Vincent StofferOpen source ↗

PolyswarmNews · Oct 28, 2025

Salt Typhoon Targets European TelecomOpen source ↗

On the same thread

Salt Typhoon, a Chinese state-linked advanced persistent threat (APT) group, attempted to infiltrate a European telecommunications organization by exploiting a vulnerability in a Citrix NetScaler Gateway appliance. The attack was first detected by Darktrace in July 2025, when threat activity consistent with Salt Typhoon’s known tactics, techniques, and procedures (TTPs) was observed. The group, also known as Earth Estries, GhostEmperor, and UNC2286, has a history of targeting telecoms and digital infrastructure globally, with previous campaigns against U.S. telecoms and ongoing interest in European targets. Initial access was achieved through the exploitation of the Citrix NetScaler Gateway, a method frequently used by Salt Typhoon to compromise network equipment. After breaching the gateway, the attackers moved laterally within the organization, targeting Citrix Virtual Delivery Agent hosts in the Machine Creation Services (MCS) subnet. The group deployed the SNAPPYBEE (also known as Deed RAT) backdoor, a tool commonly shared among Chinese APT groups, to establish command and control (C2) within the compromised environment. The C2 infrastructure utilized LightNode VPS endpoints and communicated over both HTTP and an unidentified TCP-based protocol, demonstrating the group’s use of non-standard and layered protocols to evade detection. To maintain stealth and persistence, Salt Typhoon employed DLL sideloading techniques, delivering malicious DLLs alongside legitimate antivirus executables such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This allowed the attackers to execute their payloads under the guise of trusted software, bypassing traditional security controls. The group’s tactics included abusing legitimate software for stealth and execution, a hallmark of their operations. Darktrace analysts noted that the pattern of activity closely matched Salt Typhoon’s previous campaigns, reinforcing attribution to the group. The intrusion was detected before the attackers could achieve deeper compromise or exfiltrate sensitive data, highlighting the importance of proactive threat detection. The incident underscores the persistent threat posed by Chinese cyberespionage actors to the telecommunications sector, particularly through the exploitation of known vulnerabilities in widely used network appliances. The Five Eyes intelligence alliance and other international partners have previously warned about Salt Typhoon’s global targeting of communications infrastructure. The group’s operations are believed to be conducted by private hacking firms contracted by Chinese government agencies, as revealed by earlier data leaks. The attempted breach demonstrates the evolving sophistication of state-sponsored cyber operations and the need for robust security measures in critical infrastructure sectors. The use of advanced lateral movement, stealthy persistence mechanisms, and shared malware tools reflects the group’s technical capabilities. The incident also highlights the value of threat intelligence sharing and rapid response in mitigating nation-state cyber threats. Ongoing monitoring and patching of network equipment vulnerabilities remain essential defenses against such targeted attacks. The European telecom’s timely detection and response prevented further escalation and potential operational impact. This event adds to the growing body of evidence regarding Salt Typhoon’s focus on global telecommunications espionage.

Oct 20, 2025

Salt Typhoon Cyber Espionage Campaign Targeting U.S. Telecom and Government Networks

Salt Typhoon, a threat group linked to the People’s Republic of China, conducted a multiyear cyber espionage campaign targeting major U.S. telecom providers such as Verizon, AT&T, and T-Mobile, compromising the data of hundreds of millions of users. The campaign is considered by U.S. officials to be the most significant cyber espionage operation in history, with attackers gaining access to sensitive information including call logs, unencrypted texts, and audio from high-ranking political figures, as well as targeting law enforcement intercept backdoors and military networks. The group’s activities have raised concerns about potential election interference, political blackmail, and threats to national security. Salt Typhoon exploited unpatched, end-of-life, and forgotten network perimeter devices—such as routers, VPNs, and firewalls—using sophisticated “living off the land” tactics to establish long-term persistence and evade detection. The attackers stole administrator credentials, network traffic diagrams, and personal information from military and state cybersecurity personnel, using this intelligence to fuel further intrusions. The campaign highlights the urgent need for organizations to address technical debt and proactively secure legacy infrastructure, as reactive patching cannot undo compromises on already breached devices.

Oct 24, 2025

Salt Typhoon Cyber Espionage Campaign Targeting U.S. Critical Infrastructure

U.S. officials and cybersecurity experts have highlighted the ongoing threat posed by nation-state actors, particularly the Chinese-linked group known as Salt Typhoon, which has conducted widespread cyber intrusions targeting critical American infrastructure. These campaigns have focused on stealing intellectual property, surveilling government officials, and pre-positioning within essential networks such as airports, hospitals, water treatment facilities, and telecom providers, with the intent to disrupt services or gather intelligence at a time of their choosing. The persistence and sophistication of these operations underscore the urgent need for coordinated defense efforts between government agencies and the private sector, as most critical infrastructure is privately owned or operated. Recent incidents attributed to Salt Typhoon include the compromise of multiple U.S. telecom networks, with attackers maintaining access for nearly a year before detection. These breaches exemplify the evolving nature of hybrid and cross-domain threats, where cyber intrusions can cascade into physical and reputational risks. Security leaders are being urged to adopt new, asymmetric approaches to risk management, breaking down traditional silos and ensuring that intelligence and response capabilities keep pace with the rapidly changing threat landscape.

Oct 31, 2025

Salt Typhoon Espionage Attack on European Telecommunications Provider

How this story unfolded

SecuritySenses features discussion of the Typhoon threat landscape

Reports emerge of Salt Typhoon targeting European telecoms

Related entities

Threat actors

Observables

Sources

See the full picture, correlated to your attack surface.

Salt Typhoon Espionage Attack on European Telecommunications Provider

How this story unfolded

SecuritySenses features discussion of the Typhoon threat landscape

Reports emerge of Salt Typhoon targeting European telecoms

Related entities

Threat actors

Observables

Sources

See the full picture, correlated to your attack surface.

Salt Typhoon Espionage Attack on European Telecommunications Provider

How this story unfolded

SecuritySenses features discussion of the Typhoon threat landscape

Reports emerge of Salt Typhoon targeting European telecoms

Related entities

Threat actors

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Salt Typhoon Intrusion Attempt on European Telecommunications Provider via Citrix NetScaler Exploit

Salt Typhoon Cyber Espionage Campaign Targeting U.S. Telecom and Government Networks

Salt Typhoon Cyber Espionage Campaign Targeting U.S. Critical Infrastructure

Salt Typhoon Espionage Attack on European Telecommunications Provider

How this story unfolded

SecuritySenses features discussion of the Typhoon threat landscape

Reports emerge of Salt Typhoon targeting European telecoms

Related entities

Threat actors

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Salt Typhoon Intrusion Attempt on European Telecommunications Provider via Citrix NetScaler Exploit

Salt Typhoon Cyber Espionage Campaign Targeting U.S. Telecom and Government Networks

Salt Typhoon Cyber Espionage Campaign Targeting U.S. Critical Infrastructure