- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Ministry of State Security
- Motivation
- Information theft and espionage
- Seen
- 2019–2026
- Status
- Active
- ATT&CK
- G1045 · 58 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0153 · salt-typhoon
ChinaWhat it is
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Operator Panda
- Mandiant
- UNC2286
- Trend Micro
- Earth Estries
- Other names
- FamousSparrow, GhostEmperor, Salt Typhoon (Deprecated), RedMike, Salt Typhoon, GhostEmperor
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Afghanistan, Argentina, Bangladesh, Brazil, Burkina Faso, Canada, Egypt, Ethiopia, France, Germany, Guatemala, India, Indonesia, Israel, Lithuania, Malaysia, Mexico, Netherlands, Pakistan, Philippines, Saudi Arabia, Singapore, South Africa, Swaziland, Taiwan, Thailand, United Kingdom, United States, Vietnam
- Sectors
- Chemical, Education, Engineering, Government, Hospitality, NGOs, Technology, Telecommunications, Transportation
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Backdoor.Oldrea
- China Chopper
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Ghost
- JumbledPath
- PlugX
- Remote Utilities
- RemoteCMD
- RemotePC
- SHIPSHAPE
- Windows Remote Desktop
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de