← threatfilter.dev / all groups / Salt Typhoon

Salt Typhoon

Overview

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 14 techniques across 10 tactics

Reconnaissance

T1590.004 Network Topology

Resource Development

T1587.001 Malware
T1588.002 Tool

Lateral Movement

T1021.004 SSH

Collection

T1602.002 Network Device Configuration Dump

Command and Control

T1572 Protocol Tunneling

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Tools & malware (1)

JumbledPath

Reporting (2)

Weathering the storm: In the midst of a Typhoon — Cisco Talos
Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise — US Department of Treasury