Salt Typhoon

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.^[1]^[2]^[3]^[4]^[5]^[6]^[7]^[8]

ID: G1045

Version: 2.0

Created: 24 February 2025

Last Modified: 23 September 2026

Techniques Used

Domain	ID		Name	Use
Enterprise	T1548	.003	Abuse Elevation Control Mechanism: Sudo and Sudo Caching	Salt Typhoon has elevated privileges of local user accounts by editing `/etc/sudoers` or adding a file under `/etc/sudoers.d/`.^[3]
Enterprise	T1098	.004	Account Manipulation: SSH Authorized Keys	Salt Typhoon has added SSH authorized_keys under root or other users at the Linux level on compromised network devices.^[2]^[3]
Enterprise	T1583	.003	Acquire Infrastructure: Virtual Private Server	Salt Typhoon has utilized virtual private servers (VPS) for C2 infrastructure.^[3]
Enterprise	T1595		Active Scanning	Salt Typhoon has scanned victim environments for open ports and services.^[3]
Enterprise	T1071	.001	Application Layer Protocol: Web Protocols	Salt Typhoon has utilized HTTP and HTTPS in C2 communications.^[3]
		.002	Application Layer Protocol: File Transfer Protocols	Salt Typhoon has leveraged SFTP for C2 communications.^[3]
Enterprise	T1020	.001	Automated Exfiltration: Traffic Duplication	Salt Typhoon has enabled traffic mirroring to exfiltrate data.^[3]
Enterprise	T1110	.001	Brute Force: Password Guessing	Salt Typhoon has used weak credentials to gain access to victim devices.^[3]
		.002	Brute Force: Password Cracking	Salt Typhoon has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.^[2] Salt Typhoon has cracked weak hashed passwords stolen from configuration files.^[3]
Enterprise	T1059	.004	Command and Scripting Interpreter: Unix Shell	Salt Typhoon has utilized a bash shell to execute Linux commands.^[3]
		.006	Command and Scripting Interpreter: Python	Salt Typhoon has used Python scripts to execute commands on victim hosts.^[3]
		.008	Command and Scripting Interpreter: Network Device CLI	Salt Typhoon has executed commands on network devices using the native command line interface.^[3] Salt Typhoon has leveraged Tcl scripts on Cisco IOS devices to include `TCLprox.tcl` and `map.tcl` when `tclsh` was available.^[3] Salt Typhoon also leveraged TACACS+ and RADIUS to modify victim network devices.^[3]
		.013	Command and Scripting Interpreter: Container CLI/API	Salt Typhoon has leveraged Cisco Guest Shell to interact with a Linux Container on network devices.^[3]
Enterprise	T1584	.008	Compromise Infrastructure: Network Devices	Salt Typhoon has leveraged compromised routers to facilitate operations.^[3]
Enterprise	T1136		Create Account	Salt Typhoon has created Linux-level users on compromised network devices through modification of `/etc/shadow` and `/etc/passwd`.^[2]
		.001	Local Account	Salt Typhoon has created local user accounts to utilize in victim environments.^[3] Salt Typhoon has also created administrative accounts within compromised environments.^[3]
Enterprise	T1543	.005	Create or Modify System Process: Container Service	Salt Typhoon has modified container service configurations using `Guest Shell`.^[3]
Enterprise	T1132	.001	Data Encoding: Standard Encoding	Salt Typhoon has utilized double encoding with hexadecimals in attempts to obfuscate requested command paths.^[3]
Enterprise	T1602	.001	Data from Configuration Repository: SNMP (MIB Dump)	Salt Typhoon has enumerated device configuration using SNMP and gathered data stored in the Managed Information Base on target devices.^[3]
		.002	Data from Configuration Repository: Network Device Configuration Dump	Salt Typhoon has attempted to acquire credentials by dumping network device configurations.^[2]^[3] Salt Typhoon has also obtained data using RANCID.^[3]
Enterprise	T1005		Data from Local System	Salt Typhoon has gathered data from victim devices.^[3]
Enterprise	T1610		Deploy Container	Salt Typhoon has enabled Linux containers in victim network device environments using `guestshell enable`.^[3]
Enterprise	T1587		Develop Capabilities	Salt Typhoon has hosted and attended formal training programs for foreign-made IT products to include Cisco Network Academy.^[4]
		.001	Malware	Salt Typhoon has used custom tooling including JumbledPath.^[2]
Enterprise	T1686		Disable or Modify System Firewall	Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.^[2]
		.002	Network Device Firewall	Salt Typhoon has modified the network firewalls access control lists to add IP addresses to bypass security policies and maintain access.^[3]
Enterprise	T1685		Disable or Modify Tools	Salt Typhoon has disabled logging and disabled the distribution of logs to log aggregators.^[3]
		.006	Clear Linux or Mac System Logs	Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.^[2]
Enterprise	T1585	.001	Establish Accounts: Social Media Accounts	Salt Typhoon members have created and maintained professional accounts on social media to include LinkedIn.^[4]
Enterprise	T1048	.003	Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol	Salt Typhoon has exfiltrated configuration files from exploited network devices over FTP and TFTP.^[2]^[3]
Enterprise	T1190		Exploit Public-Facing Application	Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.^[2]^[3]^[4]
Enterprise	T1590	.004	Gather Victim Network Information: Network Topology	Salt Typhoon has used configuration files from exploited network devices to help discover upstream and downstream network segments.^[2]^[3]
Enterprise	T1070	.003	Indicator Removal: Clear Command History	Salt Typhoon has deleted and cleared logs to avoid detection.^[3]
		.007	Indicator Removal: Clear Network Connection History and Configurations	Salt Typhoon has reverted or modified network configuration files to remove traces of activity.^[3]
		.009	Indicator Removal: Clear Persistence	Salt Typhoon has removed persistence within victim devices through disabling and uninstalling artifacts.^[3] Salt Typhoon has leveraged the commands `guestshell disable` and `guestshell destroy` to deactivate and uninstall Guest Shell containers and return all resources to the system to remove evidence of persistence.^[3]
Enterprise	T1105		Ingress Tool Transfer	Salt Typhoon has downloaded additional payloads and files to victim devices.^[3]
Enterprise	T1556		Modify Authentication Process	Salt Typhoon has modified the Authentication, Authorization, and Accounting (AAA) configurations forcing devices to use less secure authentication methods and to send information to their infrastructure.^[3]
Enterprise	T1599		Network Boundary Bridging	Salt Typhoon has abused peer connections to exfiltrate data.^[3]
Enterprise	T1046		Network Service Discovery	Salt Typhoon has scanned open ports and services within the victim environment.^[3]
Enterprise	T1040		Network Sniffing	Salt Typhoon has used a variety of tools and techniques to capture packet data between network interfaces.^[2]^[3]
Enterprise	T1095		Non-Application Layer Protocol	Salt Typhoon has used Generic Routing Encapsulation (GRE) and IPsec tunnels to connect to C2 over non-application layer protocols.^[3]
Enterprise	T1571		Non-Standard Port	Salt Typhoon has leveraged non-standard ports to evade detection by security monitoring.^[3]
Enterprise	T1027	.010	Obfuscated Files or Information: Command Obfuscation	Salt Typhoon has obfuscated target pathways with double encoding to bypass security solutions.^[3]
Enterprise	T1588	.002	Obtain Capabilities: Tool	Salt Typhoon has used publicly available tooling to exploit vulnerabilities.^[2]^[3] Salt Typhoon has also obtained and utilized open-source tools for creating backdoors and multi-hop proxies to include STOWAWAY.^[3]
		.005	Obtain Capabilities: Exploits	Salt Typhoon has obtained and utilized numerous exploits that target network edge devices to include Cisco IOS, Palo Alto Pan-OS Global Protect, and Ivanti Connect Secure.^[3]
Enterprise	T1572		Protocol Tunneling	Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.^[2]
Enterprise	T1090		Proxy	Salt Typhoon has utilized virtual private servers and compromised routers as proxies for malicious communications.^[3]
		.003	Multi-hop Proxy	Salt Typhoon has leveraged multi-hop proxies for command-and-control infrastructure.^[3]
Enterprise	T1021	.001	Remote Services: Remote Desktop Protocol	Salt Typhoon has opened and conducted operations utilizing RDP within victim environments.^[3]
		.004	Remote Services: SSH	Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).^[2] Salt Typhoon has also enabled SSH to allow remote access.^[3]
Enterprise	T1018		Remote System Discovery	Salt Typhoon has used SNMPwalk to enumerate devices.^[3]
Enterprise	T1072		Software Deployment Tools	Salt Typhoon has abused network management tools to include RANCID to facilitate actions in victims’ environments.^[3]
Enterprise	T1082		System Information Discovery	Salt Typhoon has discovered system information details utilizing CLI on network devices.^[3]
Enterprise	T1016		System Network Configuration Discovery	Salt Typhoon has discovered and modified network configurations of victim devices.^[3]
Enterprise	T1569		System Services	Salt Typhoon has utilized SNMP daemon to execute commands to include SNMPwalk.^[3]
Enterprise	T1199		Trusted Relationship	Salt Typhoon has leveraged compromised devices associated with trusted connections or those associated with private interconnections to include provider-to-provider or provider-to-customer relationships in order to pivot to target networks.^[3]
Enterprise	T1552	.001	Unsecured Credentials: Credentials In Files	Salt Typhoon has collected credentials stored in configuration files.^[3]
Enterprise	T1078		Valid Accounts	Salt Typhoon has used logged into accounts on Cisco devices by cracking weak hashed passwords from configuration files.^[3]

Software

ID	Name	References	Techniques
S1206	JumbledPath	^[2]	Archive Collected Data, Disable or Modify Tools, Disable or Modify Tools: Clear Linux or Mac System Logs, Hide Infrastructure, Multi-Stage Channels, Network Sniffing

Salt Typhoon

Enterprise Layer

Techniques Used

Software

References