Salt Typhoon

Salt Typhoon is a China-linked state-affiliated espionage threat actor focused on long-term compromise of telecommunications and network infrastructure. The group has been active since at least 2019 and is widely associated with sustained cyber espionage operations against major telecom providers, particularly in the United States, with reporting also tying its activity to broader targeting of global telecommunications networks and some government-related entities. Common aliases associated with this actor include GhostEmperor, Earth Estries, FamousSparrow, RedMike, Operator Panda, UNC2286, and UNC5807. Some reporting also links or associates the cluster with KELP. Public naming is inconsistent across vendors, but Salt Typhoon is the most widely recognized name in current industry and government usage. Salt Typhoon is notable for targeting core telecom environments rather than relying primarily on conventional endpoint malware. Its operations have included compromise of routers, switches, and adjacent server infrastructure; abuse of valid accounts; use of network-device command-line interfaces; collection of device configurations; creation of additional accounts; modification of access controls; and use of built-in device capabilities for persistence and surveillance. In at least one confirmed case, the actor exploited CVE-2018-0171 in Cisco Smart Install, but valid-account abuse appears to be the primary access mechanism in most reported intrusions. The group’s tradecraft emphasizes stealth, persistence, and living-off-the-land techniques. Reported behaviors include activation of Cisco Guest Shell, establishment of persistent remote access on nonstandard management channels, use of compromised network devices as pivot points, traffic mirroring for collection, and tunneling through standard network protocols to move data and maintain command and control. On supporting server infrastructure, Salt Typhoon has also been linked to tooling such as GhostSpider, Demodex, SnappyBee, HemiGate, and Cobalt Strike, as well as DLL sideloading through legitimate software. Operational objectives are consistent with strategic state espionage: interception of communications, mapping of internal telecom networks, theft of sensitive configuration and access data, compromise of lawful-intercept environments, and maintenance of prepositioned access that could support future intelligence collection or disruptive operations. Public reporting has described intrusions affecting major U.S. carriers including AT&T, Verizon, T-Mobile, Lumen Technologies, and Charter Communications, with some compromises reportedly persisting for years. Behaviorally, Salt Typhoon overlaps with other Chinese intrusion sets such as Volt Typhoon in its use of legitimate administration mechanisms, low-malware operations, and emphasis on persistence in critical infrastructure. However, Salt Typhoon is distinguished by its concentration on telecommunications espionage and surveillance. Defensively relevant ATT&CK-aligned behaviors include Valid Accounts, Network Device CLI, Web Shell, Data from Configuration Repository, Traffic Duplication, Protocol Tunneling, and use of network infrastructure as operational pivot points.