Threat-actor profile

← Back to main site

Home/ Threat Actors/ Salt Typhoon

🇨🇳Salt Typhoon

🇨🇳 Salt Typhoon is a tracked threat actor in the Clankerusecase corpus. Attributed to CN. Primary motivation: State. We map 26 detection use cases to this actor across 51 MITRE ATT&CK techniques, with 4 threat-intel articles citing them. Active in our corpus from 2025-11-06 to 2026-05-28.

crit 4

View full actor card → All threat actors MITRE ATT&CK group spec (G1045) ↗

26Use cases

4Articles

51Techniques

1IOCs

Known aliases

Salt TyphoonGhostEmperorFamousSparrowEarth Estries

Top techniques

T1190 · Exploit Public-Facing Application T1204.002 · Malicious File T1021.002 · SMB/Windows Admin Shares

All other tracked techniques

T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1021.004 · SSH T1027 · Obfuscated Files or Information T1036.005 · Match Legitimate Resource Name or Location T1040 · Network Sniffing T1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol T1055.012 · Process Hollowing T1059.001 · PowerShell T1059.003 · Windows Command Shell T1059.005 · Visual Basic T1059.007 · JavaScript T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.004 · DNS T1095 · Non-Application Layer Protocol T1098.004 · SSH Authorized Keys T1102.002 · Bidirectional Communication T1105 · Ingress Tool Transfer T1110.002 · Password Cracking T1136 · Create Account T1195.002 · Compromise Software Supply Chain T1203 · Exploitation for Client Execution T1204.001 · Malicious Link T1204.004 · Malicious Copy and Paste T1218 · System Binary Proxy Execution T1219 · Remote Access Tools T1486 · Data Encrypted for Impact T1539 · Steal Web Session Cookie T1546.016 · Installer Packages T1547.001 · Registry Run Keys / Startup Folder T1555.003 · Credentials from Web Browsers T1560 · Archive Collected Data T1566 · Phishing T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1567 · Exfiltration Over Web Service T1567.002 · Exfiltration to Cloud Storage T1568.002 · Domain Generation Algorithms T1569.002 · Service Execution T1572 · Protocol Tunneling T1574.002 · T1574.002 T1587.001 · Malware T1588.002 · Tool T1590.004 · Network Topology T1602.002 · Network Device Configuration Dump T1685.006 · Clear Linux or Mac System Logs T1686 · Disable or Modify System Firewall

Detection use cases (26)

Salt Typhoon (Earth Estries) GhostSpider/SnappyBee DLL sideloading via signed Notepad++/MSDTC/.NET hosts with external TLS C2 AI · profile SΣDD Salt Typhoon LSASS credential extraction + packet-capture deployment on telecom / network-engineering hosts (lawful-intercept targeting) AI · profile SDD Trojanized axios npm package postinstall: node.exe spawned from plain-crypto-js dependency Bespoke axios RAT Windows persistence: %PROGRAMDATA%\wt.exe drop + %TEMP%\6202033.vbs/.ps1 staging Bespoke axios RAT C2 callout to sfrclak.com / 142.11.206.73:8000 Bespoke Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal Ransomware-style mass file rename / extension change Internal LSASS process access / dump (credential theft) Internal Remote service execution — PsExec / SMB lateral movement Internal Trusted vendor binary / installer launching unusual children Internal Non-browser process posting to Slack Web API (LaxGopher C2) Bespoke Non-browser process posting to Discord API (RatGopher C2) Bespoke Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) MITRE match Authentication not detected on admin API endpoint MITRE match AWS S3 bucket ACL / policy made public MITRE match DNS tunneling / TXT-heavy domain queries MITRE match Excessive resource consumption of third-party API MITRE match GitHub personal access token created MITRE match GitHub SSH key added from suspicious IP MITRE match GitLab personal access token generated MITRE match JWT authentication bypass attempt MITRE match Local File Inclusion (LFI) exploited MITRE match

Threat-intel articles (4)

crit ESET APT Activity Report Q4 2025–Q1 2026 · 2026-05-28

crit GopherWhisper: A burrow full of malware · 2026-04-23

crit How SMBs use threat research and MDR to build a defensive edge · 2026-03-05

crit ESET APT Activity Report Q2 2025–Q3 2025 · 2025-11-06

Tracked indicators

IP addresses (1)

43.231.113.50

CVEs (2)

CVE-2024-42009 CVE-2025-8088