Salt Typhoon

Salt Typhoon is a China-linked, state-sponsored espionage threat actor. The provided content identifies Ghost Emperor as overlapping with or tracked under the aliases Earth Estries, FamousSparrow, Operator Panda, RedMike/Red Mike, UNC2286, and UNC5807, with reporting stating that activity partially overlaps with campaigns tracked as Salt Typhoon, RedMike, OPERATOR PANDA, UNC5807, and Ghost Emperor. The content also notes tactical overlap between FamousSparrow and clusters tracked as Earth Estries and Salt Typhoon. The actor is associated primarily with large-scale espionage against telecommunications providers and related infrastructure. Reporting in the content states that Salt Typhoon penetrated global telecommunications networks, including major U.S. providers such as AT&T, Verizon, Lumen, Charter Communications, Windstream, and other telecom companies in dozens of countries. The group reportedly compromised systems used for lawful intercept and court-authorized wiretap requests, obtained a nearly complete list of phone numbers monitored by the U.S. Justice Department lawful intercept system, accessed customer call and text metadata from more than one million users, and in some cases may have captured phone audio involving senior U.S. political figures. Multiple items in the content state that investigators believed the actors retained access for months or longer and that the United States could not confidently assert the actors had been fully removed. The content further states that Salt Typhoon breached a U.S. state National Guard network from March 2024 to December 2024 and likely exfiltrated configuration files, administrator credentials, and network diagrams tied to critical infrastructure organizations and state agencies. A Department of Defense report cited in the content says the group had previously stolen 1,462 configuration files associated with 70 U.S. government and critical infrastructure identities across 12 sectors, including energy, communications, transportation, and wastewater, and assessed that such data could facilitate follow-on intrusions. Targeting described in the content extends beyond telecom. Salt Typhoon or overlapping clusters are mentioned in relation to finance, energy, and utilities sectors. Separate reporting in the content says FamousSparrow targeted a Venezuelan governmental entity connected to maritime affairs, and Bitdefender attributed an intrusion into an Azerbaijani oil and gas company to FamousSparrow with moderate-to-high confidence while noting overlap with the Earth Estries threat ecosystem. Tradecraft and operational characteristics directly mentioned in the content include long-term persistence in victim environments, movement from one telecom network to another, use of dozens of domains over at least five years, and exploitation of telecom and network infrastructure at scale. The broader reporting characterizes Salt Typhoon as part of Chinese state-backed cyber espionage and specifically links the campaign to China and, in some reporting, to China’s Ministry of State Security.