Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.12345678
- US Dept. of Treasury Salt Typhoon JAN 2025
- Cisco Salt Typhoon FEB 2025
- CISA_AA25-239ASaltTyphoon_Sept2025
- CarySentinelLabs_CiscoSaltTyphoon_Dec2025
- CrowdStrike_OperatorPanda_NoDate
- RF_SaltTyphoon_Feb2025
- Microsoft_ThreatActorNaming_NoDate
- Mandiant_M-Trends2026_Mar2026
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1584.008 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.007 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1610 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.009 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1602.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1602.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.008 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1599 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.013 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2025 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1020.001 | Traffic Duplication | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1027.010 | Command Obfuscation | — |
| T1040 | Network Sniffing | — |
| T1046 | Network Service Discovery | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1059.004 | Unix Shell | — |
| T1059.006 | Python | — |
| T1059.008 | Network Device CLI | — |
| T1059.013 | Container CLI/API | — |
| T1070.003 | Clear Command History | — |
| T1070.007 | Clear Network Connection History and Configurations | — |
| T1070.009 | Clear Persistence | — |
| T1071.001 | Web Protocols | — |
| T1071.002 | File Transfer Protocols | — |
| T1072 | Software Deployment Tools | — |
| T1078 | Valid Accounts | — |
| T1082 | System Information Discovery | — |
| T1090 | Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1095 | Non-Application Layer Protocol | — |
| T1098.004 | SSH Authorized Keys | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.001 | Password Guessing | — |
| T1110.002 | Password Cracking | — |
| T1132.001 | Standard Encoding | — |
| T1136 | Create Account | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1543.005 | Container Service | — |
| T1548.003 | Sudo and Sudo Caching | — |
| T1552.001 | Credentials In Files | — |
| T1556 | Modify Authentication Process | — |
| T1569 | System Services | — |
| T1571 | Non-Standard Port | — |
| T1572 | Protocol Tunneling | — |
| T1583.003 | Virtual Private Server | — |
| T1584.008 | Network Devices | — |
| T1585.001 | Social Media Accounts | — |
| T1587 | Develop Capabilities | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1588.005 | Exploits | — |
| T1590.004 | Network Topology | — |
| T1595 | Active Scanning | — |
| T1599 | Network Boundary Bridging | — |
| T1602.001 | SNMP (MIB Dump) | — |
| T1602.002 | Network Device Configuration Dump | — |
| T1610 | Deploy Container | — |
| T1685 | Disable or Modify Tools | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1686 | Disable or Modify System Firewall | — |
| T1686.002 | Network Device Firewall | — |
Aliases
Salt Typhoon
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.