Salt Typhoon

Salt Typhoon, also known as Earth Estries, FamousSparrow, GhostEmperor, and UNC2286, is a threat actor linked to China's Ministry of State Security. Active since at least 2020, this advanced persistent threat (APT) group has a history of targeting U.S. systems for intelligence gathering, particularly those critical to national security. The group has compromised several U.S. internet service providers (ISPs), including Verizon, AT&T, Lumen, and T-Mobile, with the aim of exfiltrating data from systems used to manage court-authorized wiretaps of subscriber network traffic. The cyber campaign led by Salt Typhoon has been attributed to a series of attacks on high-value government and telecommunications organizations. In 2023, Salt Typhoon was observed compromising consulting firms and non-governmental organizations (NGOs) that work with the U.S. government and military, aiming to breach these entities more quickly and effectively. Notably, Salt Typhoon does not typically exploit vulnerabilities directly in its target's network but uses a diverse arsenal of malware to infiltrate and compromise networks. Salt Typhoon's operations have been closely monitored and analyzed by cybersecurity researchers. The group consistently builds out its arsenal of varied and powerful payloads, which it deploys once it gains access to a targeted network. One recent addition to this arsenal is a backdoor malware dubbed GhostSpider. In response to the ongoing threat posed by Salt Typhoon, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint statement detailing the major Chinese cyber-espionage campaign targeting U.S. telecommunications infrastructure.