Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.12345678
- US Dept. of Treasury Salt Typhoon JAN 2025
- Cisco Salt Typhoon FEB 2025
- CISA_AA25-239ASaltTyphoon_Sept2025
- CarySentinelLabs_CiscoSaltTyphoon_Dec2025
- CrowdStrike_OperatorPanda_NoDate
- RF_SaltTyphoon_Feb2025
- Microsoft_ThreatActorNaming_NoDate
- Mandiant_M-Trends2026_Mar2026
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Salt Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.007 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1610 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.009 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1602.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1602.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.008 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1599 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.013 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2025 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1020.001 | Traffic Duplication | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1027.010 | Command Obfuscation | — |
| T1040 | Network Sniffing | — |
| T1046 | Network Service Discovery | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1059.004 | Unix Shell | — |
| T1059.006 | Python | — |
| T1059.008 | Network Device CLI | — |
| T1059.013 | Container CLI/API | — |
| T1070.003 | Clear Command History | — |
| T1070.007 | Clear Network Connection History and Configurations | — |
| T1070.009 | Clear Persistence | — |
| T1071.001 | Web Protocols | — |
| T1071.002 | File Transfer Protocols | — |
| T1072 | Software Deployment Tools | — |
| T1078 | Valid Accounts | — |
| T1082 | System Information Discovery | — |
| T1090 | Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1095 | Non-Application Layer Protocol | — |
| T1098.004 | SSH Authorized Keys | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.001 | Password Guessing | — |
| T1110.002 | Password Cracking | — |
| T1132.001 | Standard Encoding | — |
| T1136 | Create Account | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1543.005 | Container Service | — |
| T1548.003 | Sudo and Sudo Caching | — |
| T1552.001 | Credentials In Files | — |
| T1556 | Modify Authentication Process | — |
| T1569 | System Services | — |
| T1571 | Non-Standard Port | — |
| T1572 | Protocol Tunneling | — |
| T1583.003 | Virtual Private Server | — |
| T1584.008 | Network Devices | — |
| T1585.001 | Social Media Accounts | — |
| T1587 | Develop Capabilities | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1588.005 | Exploits | — |
| T1590.004 | Network Topology | — |
| T1595 | Active Scanning | — |
| T1599 | Network Boundary Bridging | — |
| T1602.001 | SNMP (MIB Dump) | — |
| T1602.002 | Network Device Configuration Dump | — |
| T1610 | Deploy Container | — |
| T1685 | Disable or Modify Tools | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1686 | Disable or Modify System Firewall | — |
| T1686.002 | Network Device Firewall | — |
别名
Salt Typhoon
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。