Salt Typhoon

G1045

APT / State-SponsoredChinaActive

Active Since

2025-02-24

Overview

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).

MITRE ATT&CK — 14 techniques

Navigator →

T1685.006Clear Linux or Mac System LogsDefense Impairment

T1590.004Network TopologyReconnaissance

T1572Protocol TunnelingCommand and Control

T1587.001MalwareResource Development

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolExfiltration

T1098.004SSH Authorized KeysPersistence

T1040Network SniffingCredential Access

T1602.002Network Device Configuration DumpCollection

T1110.002Password CrackingCredential Access

T1021.004SSHLateral Movement

T1686Disable or Modify System FirewallDefense Impairment

T1588.002ToolResource Development

T1136Create AccountPersistence

T1190Exploit Public-Facing ApplicationInitial Access

Malware & Tools — 1

JumbledPathMalwareNetwork Devices

References

https://blog.talosintelligence.com/salt-typhoon-analysis/ →https://home.treasury.gov/news/press-releases/jy2792 →

← Back to Threat Actors