MITRE ATT&CKgroup
G1045 Salt Typhoon
- Domain
- enterprise
- Version
- 2.0
- Created
- 2025-02-24
Description
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.
Related
Uses · MITRE ATT&CK (59)
- T1685 Disable or Modify Tools technique
- T1685.006 Clear Linux or Mac System Logs sub-technique
- T1686 Disable or Modify System Firewall technique
- T1686.002 Network Device Firewall sub-technique
- T1059.013 Container CLI/API sub-technique
- S1206 JumbledPath software (malware)
- T1584.008 Network Devices sub-technique
- T1543.005 Container Service sub-technique
- T1027.010 Command Obfuscation sub-technique
- T1070.009 Clear Persistence sub-technique
- T1070.007 Clear Network Connection History and Configurations sub-technique
- T1610 Deploy Container technique
- T1059.008 Network Device CLI sub-technique
- T1602.002 Network Device Configuration Dump sub-technique
- T1020.001 Traffic Duplication sub-technique
- T1599 Network Boundary Bridging technique
- T1602.001 SNMP (MIB Dump) sub-technique
- T1590.004 Network Topology sub-technique
- T1595 Active Scanning technique
- T1583.003 Virtual Private Server sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1587 Develop Capabilities technique
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1588.005 Exploits sub-technique
- T1098.004 SSH Authorized Keys sub-technique
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.002 File Transfer Protocols sub-technique
- T1572 Protocol Tunneling technique
References
- https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/ CarySentinelLabs_CiscoSaltTyphoon_Dec2025
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a CISA_AA25-239ASaltTyphoon_Sept2025
- https://blog.talosintelligence.com/salt-typhoon-analysis/ Cisco Salt Typhoon FEB 2025
- https://www.crowdstrike.com/en-us/adversaries/operator-panda/ CrowdStrike_OperatorPanda_NoDate
- https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices RF_SaltTyphoon_Feb2025
- https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026 Mandiant_M-Trends2026_Mar2026
- https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming Microsoft_ThreatActorNaming_NoDate
- https://home.treasury.gov/news/press-releases/jy2792 US Dept. of Treasury Salt Typhoon JAN 2025