Cyber threat actor
Salt Typhoon
PRC state-sponsored (MSS contractor) · active since 2020
Long-running telecom intrusion campaign. In 2024 breached multiple US carriers and accessed CALEA lawful-intercept systems, exposing communications of senior US officials.
Aliases
FamousSparrowGhostEmperorEarth Estries
Primary targets
US telecom carriers ISPs Government communications Political campaigns
MITRE ATT&CK techniques
4 techniques mapped · click any technique ID to open the MITRE ATT&CK entry, any CVE to view its NVD record, or any citation for source reporting.
| Tactic | Technique | Procedure | Targets | Citation |
|---|---|---|---|---|
| Initial Access | T1190 Exploit Public-Facing Application | Exploited Microsoft Exchange and edge router vulnerabilities to gain access to telecom networks. | US/global telecom carriers | Trend Micro Earth Estries |
| Persistence | T1014 Rootkit (Demodex / GhostSpider) | Deployed Demodex kernel rootkit and GhostSpider modular backdoor on telecom infrastructure. | Carrier core network elements | Trend Micro Earth Estries |
| Collection | T1114 Email / Comms Collection | Accessed CALEA lawful-intercept systems to harvest call records and content of senior US officials. | Verizon, AT&T, Lumen | WSJ reporting |
| Command & Control | T1071.001 Application Layer Protocol: HTTPS | Custom HTTPS tunnels over compromised infrastructure for low-and-slow C2. | - | Trend Micro Earth Estries |
Curated incidents
- 2024-12-15·Telecom·United StatesSalt Typhoon breach exposes US lawful-intercept systems
Verizon, AT&T, Lumen confirm intrusion; metadata of senior US officials accessed.
Live feed mentions
- Thu, 13 Feb 2025 12:00:00 GMT · Recorded Future Insikt GroupRecorded Future Insikt Group: RedMike (Salt Typhoon) exploits unpatched Cisco devices at telecom providers
- Thu, 13 Feb 2025 08:00:00 GMT · WIREDWIRED: Salt Typhoon keeps hacking telecoms despite sanctions
- Fri, 17 Jan 2025 15:00:00 GMT · US Department of the TreasuryTreasury sanctions Sichuan Juxinhe Network Technology over Salt Typhoon telecom intrusions
- Wed, 13 Nov 2024 17:00:00 GMT · FBI / CISA joint statementJoint Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency statement on telecom targeting