Salt Typhoon
GhostEmperor is referenced with aliases including Earth Estries, FamousSparrow, Operator Panda, RedMike/Red Mike, Salt Typhoon, UNC2286, and UNC5807. Based on the provided content, the most widely recognized current name is Salt Typhoon. The content describes Salt Typhoon as a PRC-linked, China-aligned threat group involved in cyber espionage and persistent access operations, including maintaining long-term access inside major U.S. telecommunications providers in 2024. The group is discussed in the context of Chinese state-sponsored activity and broader Chinese contractor-enabled cyber operations. The reporting associates Salt Typhoon with telecommunications targeting and strategic intelligence collection. The content states that the group operated infrastructure useful for Harvest Now, Decrypt Later collection at scale, and that U.S. regulators cited Salt Typhoon-type incidents when tightening telecom and submarine cable security rules. Additional reporting says U.S. and partner governments attributed Salt Typhoon activity to at least three China-based private firms, and the UK NCSC stated that private firms enabled the activity, though specific tasking relationships and roles remained largely undescribed publicly as of mid-2025. Tradecraft directly associated with Salt Typhoon in the content centers heavily on Cisco network device activity. Splunk analytics tied to the Salt Typhoon analytic story describe suspicious behaviors including Cisco IOS-XE tunnel interface creation with tunnel source and destination plus 10.10.12.0/24 addressing; suspicious use of "request platform software package describe" with shell-style filename patterns; WebUI programmatic configuration via the SEP_webui_wsma_http process; WebUI logins involving local port 21111 as a strong indicator of exploitation; bursts of SSH, Telnet-to-port-22, and ping activity across multiple IPs in a short window; reconnaissance command bursts such as show running-config, show tacacs, show cdp neighbors, show file systems, dir bootflash, and terminal formatting commands; Guestshell enablement followed by destruction; log-clearing sequences including show logging, clear logging, and exit; and rapid VTY access-class removal and re-application following HTTP configuration activity. These behaviors map to reconnaissance, remote services, proxying/tunneling, exploitation of public-facing applications, command execution, defense evasion, and valid-account abuse. The content also places Salt Typhoon among representative Chinese state-sponsored actors alongside APT41 and Volt Typhoon, and cites it as an example of how Chinese cyber campaigns rely on a commercial support layer of private firms, contractors, and data brokers.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Telecommunication Services
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
67 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
33 malware families attributed to this actor across reporting.
28 additional families tracked in Mallory.
Associated vulnerabilities
24 CVEs this actor has used in observed campaigns. 24 of them exploited in the wild.
The Australian Signals Directorate (ASD) recently issued a high-severity alert about an ongoing cyber attack campaign exploiting a critical vulnerability in Cisco IOS XE devices, tracked as CVE-2023-20198. This vulnerability has a perfect CVSS score of 10.0, reflecting its extreme risk, and has been actively exploited since 2023.
The process command line contained the MSExchangePowerShellAppPool argument, indicating that the attacker exploited the Exchange server via the ProxyNotShell exploit chain... ProxyNotShell (CVE-2022-41040, CVE-2022-41082) is a related exploit chain disclosed in 2022. Both allow unauthenticated attackers to execute code on unpatched Exchange servers.
In 2025, it was reported that Russian government-sponsored ransomware gangs Static Tundra and Salt Typhoon exploited the CVE-2018–0171 vulnerability in unpatched Cisco equipment. The CVE-2018–0171 vulnerability in Cisco IOS and IOS XE allows a remote threat actor to execute arbitrary commands without authentication, and it was disclosed that the vulnerability was used to gain initial access.
Both groups were also early exploiters of the ProxyLogon vulnerability (CVE-2021-26855) and have used some of the same publicly available tools.
Salt Typhoon has exploited vulnerabilities in Cisco edge devices (notably CVE-2023-20198 and CVE-2023-20273) to gain unauthorized access to telecom networks.
19 more CVEs tied to this actor tracked in Mallory.
Observables
159 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an ongoing cyber threat problem tied to hacks affecting U.S. concerns around telecommunications and critical infrastructure security.
Referenced as a threat actor associated with recording calls of top American officials.
Maintained persistent access inside major US telecommunications providers, with infrastructure and access patterns described as useful for large-scale Harvest Now, Decrypt Later collection.
Cyber espionage campaign against Western telecommunications infrastructure, described as relying on China-based private firms that enabled the activity.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.