Threat-actor profile

← Back to main site

Home/ Threat Actors/ Salt Typhoon

🇨🇳Salt Typhoon

🇨🇳 Salt Typhoon is a tracked threat actor in the Clankerusecase corpus. Attributed to CN. Primary motivation: State. We map 26 detection use cases to this actor across 48 MITRE ATT&CK techniques, with 3 threat-intel articles citing them. Active in our corpus from 2026-03-05 to 2026-05-28.

crit 3

View full actor card → All threat actors MITRE ATT&CK group spec (G1045) ↗

26Use cases

3Articles

48Techniques

1IOCs

Known aliases

Salt TyphoonGhostEmperorFamousSparrowEarth Estries

Top techniques

T1190 · Exploit Public-Facing Application T1204.002 · Malicious File T1486 · Data Encrypted for Impact

All other tracked techniques

T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1021.002 · SMB/Windows Admin Shares T1021.004 · SSH T1027 · Obfuscated Files or Information T1036.005 · Match Legitimate Resource Name or Location T1040 · Network Sniffing T1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol T1055.012 · Process Hollowing T1059.001 · PowerShell T1059.003 · Windows Command Shell T1059.005 · Visual Basic T1059.007 · JavaScript T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.004 · DNS T1095 · Non-Application Layer Protocol T1098.004 · SSH Authorized Keys T1102.002 · Bidirectional Communication T1105 · Ingress Tool Transfer T1110.002 · Password Cracking T1136 · Create Account T1195.002 · Compromise Software Supply Chain T1204.001 · Malicious Link T1218 · System Binary Proxy Execution T1539 · Steal Web Session Cookie T1546.016 · Installer Packages T1547.001 · Registry Run Keys / Startup Folder T1555.003 · Credentials from Web Browsers T1560 · Archive Collected Data T1566 · Phishing T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1567 · Exfiltration Over Web Service T1567.002 · Exfiltration to Cloud Storage T1568.002 · Domain Generation Algorithms T1569.002 · Service Execution T1572 · Protocol Tunneling T1574.002 · T1574.002 T1587.001 · Malware T1588.002 · Tool T1590.004 · Network Topology T1602.002 · Network Device Configuration Dump T1685.006 · Clear Linux or Mac System Logs T1686 · Disable or Modify System Firewall

Detection use cases (26)

Salt Typhoon (GhostEmperor/Earth Estries) DLL side-load of Demodex/ShadowPad/SparrowDoor from staging dirs AI · profile SΣDD Salt Typhoon / Earth Estries data exfiltration via curl upload to public file-sharing services AI · profile SΣDD Trojanized axios npm package postinstall: node.exe spawned from plain-crypto-js dependency Bespoke axios RAT Windows persistence: %PROGRAMDATA%\wt.exe drop + %TEMP%\6202033.vbs/.ps1 staging Bespoke axios RAT C2 callout to sfrclak.com / 142.11.206.73:8000 Bespoke Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal Ransomware-style mass file rename / extension change Internal LSASS process access / dump (credential theft) Internal Remote service execution — PsExec / SMB lateral movement Internal Trusted vendor binary / installer launching unusual children Internal Non-browser process posting to Slack Web API (LaxGopher C2) Bespoke Non-browser process posting to Discord API (RatGopher C2) Bespoke Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) MITRE match Web-Facing Service Process Writes to RCE/Persistence Paths (Path-Traversal File-Write) MITRE match Authentication not detected on admin API endpoint MITRE match AWS S3 bucket ACL / policy made public MITRE match DNS tunneling / TXT-heavy domain queries MITRE match Excessive resource consumption of third-party API MITRE match GitHub personal access token created MITRE match GitHub SSH key added from suspicious IP MITRE match GitLab personal access token generated MITRE match JWT authentication bypass attempt MITRE match

Threat-intel articles (3)

crit ESET APT Activity Report Q4 2025–Q1 2026 · 2026-05-28

crit GopherWhisper: A burrow full of malware · 2026-04-23

crit How SMBs use threat research and MDR to build a defensive edge · 2026-03-05

Tracked indicators

IP addresses (1)

43.231.113.50