Granite Typhoon

Granite Typhoon is a malware attributed to China-based cyber actors, specifically the groups Raspberry Typhoon, Flax Typhoon, and Granite Typhoon. These entities have been known to target IT, military, and government interests around the South China Sea. The malicious software can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it has the potential to steal personal information, disrupt operations, or hold data for ransom. In 2023, the group was linked with attacks on telecommunications firms in an operation dubbed "Tainted Love" by SentinelOne. Microsoft has also associated the group with Granite Typhoon, previously known as Gallium. The attacks targeted various governmental entities including critical infrastructure, public healthcare institutions, public financial administrators, and ministries. The attribution of these attacks has been moderately confident to three separate clusters tracked as Stately Taurus (also known as Mustang Panda), Alloy Taurus (also known as Granite Typhoon), and Gelsemium. Microsoft tracks the malware under the name Granite Typhoon. The naming convention for these threat actors seems random, resulting in impressively named threats like Ghost Blizzard, Ruby Sleet, and Granite Typhoon.