Salt Typhoon

Salt Typhoon is a China-linked state-sponsored cyberespionage threat actor associated across reporting with the aliases GhostEmperor, Earth Estries, FamousSparrow, RedMike, UNC2286, and UNC5807. The cluster is best known for long-running espionage operations against telecommunications providers and government environments, including major compromises of U.S. telecommunications infrastructure, and has also been linked to activity affecting universities, technology organizations, and other critical infrastructure targets worldwide. The actor’s operations emphasize intelligence collection rather than disruption or monetization. Reported tradecraft includes systematic exploitation of internet-facing edge infrastructure and network appliances, especially public-facing web interfaces on Cisco IOS XE devices and flaws in products such as Ivanti Connect Secure, Sophos Firewall, and Fortinet FortiClient EMS. In multiple campaigns, the group exploited known vulnerabilities to obtain initial access and elevated privileges on network devices, then modified device configurations and established GRE tunnels to maintain covert access and support data theft. Other reporting indicates the actor has also used valid or stolen credentials in some Cisco-related intrusions, underscoring a flexible approach to compromising edge infrastructure. Salt Typhoon has been described as highly capable and stealth-focused. Observed behaviors include exploitation of public-facing applications, credential theft, network sniffing, privilege escalation, lateral movement, persistence through service creation and configuration changes, covert exfiltration, and use of custom malware and command-and-control infrastructure. Detection content and incident reporting also associate the cluster with living-off-the-land techniques, log suppression or disabling, and avoidance of traditional malware on some network-device compromises. In Windows intrusions attributed or suspected to be linked to GhostEmperor, reporting has described DLL side-loading, process hollowing, reconnaissance, LSASS dumping, searches for domain credential material, archival of collected data, and exfiltration to external services. Targeting has been especially prominent in the telecommunications sector, where the actor has compromised carriers and internet service providers to access communications and sensitive network data. Public reporting also places its victims in government and public-sector organizations, technology entities, universities, and broader critical infrastructure. Countries explicitly associated with targeting include the United States, the Philippines, Taiwan, Malaysia, South Africa, Germany, Indonesia, and Vietnam. The naming and clustering around Salt Typhoon, GhostEmperor, Earth Estries, and FamousSparrow are not uniform across vendors, but the supplied reporting repeatedly treats these names as the same actor or closely overlapping operational cluster. At high confidence, the actor is best characterized as a PRC-linked espionage group focused on strategic intelligence collection through compromise of telecommunications and other internet-facing critical infrastructure.