Introduction
Salt Typhoon is a People’s Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807. US Dept. of Treasury Salt Typhoon JAN 2025 Cisco Salt Typhoon FEB 2025 CISA_AA25-239ASaltTyphoon_Sept2025 CarySentinelLabs_CiscoSaltTyphoon_Dec2025 CrowdStrike_OperatorPanda_NoDate RF_SaltTyphoon_Feb2025 Microsoft_ThreatActorNaming_NoDate Mandiant_M-Trends2026_Mar2026
Activities and Tactics
Country of Origin: 🇨🇳 China
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1584.008 Network Devices
- T1070.007 Clear Network Connection History and Configurations
- T1016 System Network Configuration Discovery
- T1685.006 Clear Linux or Mac System Logs
- T1686.002 Network Device Firewall
- T1082 System Information Discovery
- T1552.001 Credentials In Files
- T1590.004 Network Topology
- T1046 Network Service Discovery
- T1610 Deploy Container
- T1556 Modify Authentication Process
- T1070.009 Clear Persistence
- T1572 Protocol Tunneling
- T1095 Non-Application Layer Protocol
- T1021.001 Remote Desktop Protocol
- T1090.003 Multi-hop Proxy
- T1569 System Services
- T1027.010 Command Obfuscation
- T1548.003 Sudo and Sudo Caching
- T1587.001 Malware
- T1602.001 SNMP (MIB Dump)
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1098.004 SSH Authorized Keys
- T1595 Active Scanning
- T1020.001 Traffic Duplication
- T1078 Valid Accounts
- T1070.003 Clear Command History
- T1040 Network Sniffing
- T1583.003 Virtual Private Server
- T1602.002 Network Device Configuration Dump
- T1571 Non-Standard Port
- T1090 Proxy
- T1110.002 Password Cracking
- T1059.008 Network Device CLI
- T1136.001 Local Account
- T1059.004 Unix Shell
- T1072 Software Deployment Tools
- T1543.005 Container Service
- T1587 Develop Capabilities
- T1071.001 Web Protocols
- T1021.004 SSH
- T1071.002 File Transfer Protocols
- T1018 Remote System Discovery
- T1686 Disable or Modify System Firewall
- T1005 Data from Local System
- T1588.005 Exploits
- T1110.001 Password Guessing
- T1105 Ingress Tool Transfer
- T1585.001 Social Media Accounts
- T1059.006 Python
- T1685 Disable or Modify Tools
- T1599 Network Boundary Bridging
- T1588.002 Tool
- T1132.001 Standard Encoding
- T1059.013 Container CLI/API
- T1136 Create Account
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
ATT&CK technique IDs (denormalized)
- T1005
- T1016
- T1018
- T1020.001
- T1021.001
- T1021.004
- T1027.010
- T1040
- T1046
- T1048.003
- T1059.004
- T1059.006
- T1059.008
- T1059.013
- T1070.003
- T1070.007
- T1070.009
- T1071.001
- T1071.002
- T1072
- T1078
- T1082
- T1090
- T1090.003
- T1095
- T1098.004
- T1105
- T1110.001
- T1110.002
- T1132.001
- T1136
- T1136.001
- T1190
- T1199
- T1543.005
- T1548.003
- T1552.001
- T1556
- T1569
- T1571
- T1572
- T1583.003
- T1584.008
- T1585.001
- T1587
- T1587.001
- T1588.002
- T1588.005
- T1590.004
- T1595
- T1599
- T1602.001
- T1602.002
- T1610
- T1685
- T1685.006
- T1686
- T1686.002
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- China Chopper:
- CyberGate:
- Cyber Eye RAT:
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [2] CarySentinelLabs_CiscoSaltTyphoon_Dec2025 Cary, D. (2025, December 10). Malicious Apprentice | How Two Hackers Went From Cisco Academy to Cisco CVEs. Retrieved September 22, 2026. [3] CISA_AA25-239ASaltTyphoon_Sept2025 CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026. [4] Cisco Salt Typhoon FEB 2025 Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025. [5] CrowdStrike_OperatorPanda_NoDate CrowdStrike. (n.d.). Operator Panda. Retrieved September 22, 2026. [6] RF_SaltTyphoon_Feb2025 Insikt Group. (2025, February 13). RedMike (Salt Typhoon) Exploits Cisco Vulnerabilities for Cyber Espionage. Retrieved September 22, 2026. [7] Mandiant_M-Trends2026_Mar2026 Kutscher, J. (2026, March 23). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Retrieved September 22, 2026. [8] Microsoft_ThreatActorNaming_NoDate Microsoft. (n.d.). How Microsoft names threat actors. Retrieved September 22, 2026. [9] US Dept. of Treasury Salt Typhoon JAN 2025 US Department of Treasury. (2025, January 17). Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise. Retrieved February 24, 2025.
Recent News
Latest articles from security news feeds mentioning this actor.
- China’s FamousSparrow APT Spies on US Politics in Latin America DarkReading — 2026-09-17 — tags: apt
- China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America The Hacker News — 2026-09-17