Log in Request a demo

Threat group profile

Salt Typhoon

Also known as OPERATOR PANDA, RedMike, GhostEmperor

MITRE ATT&CK attributes Salt Typhoon to the PRC state and says it has been active since at least 2019. Salt Typhoon compromised network equipment at major US telecommunications and internet providers.

In short

MITRE ATT&CK attributes Salt Typhoon to the PRC state and says it has been active since at least 2019. Salt Typhoon compromised network equipment at major US telecommunications and internet providers. A joint advisory by 13 countries (27 August 2025) says PRC state-sponsored actors with partly overlapping activity mostly exploit known flaws in routers and edge devices. Patch and lock down those devices first.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginChina
  2. Names5names in public reportsSalt Typhoon · OPERATOR PANDA · RedMike
  3. Sectors11named as targetsMajor US carriers and ISPs · Networks worldwide · A cluster of activity
  4. Techniques14in the attack chainReconnaissance · Resource Development · Initial Access
  5. Tools7tools and malware listedJumbledPath · STOWAWAY · Guest Shell

In one minute

Who they are
MITRE ATT&CK describes Salt Typhoon as a People's Republic of China (PRC) state-backed actor active since at least 2019. On 17 January 2025 the US Treasury sanctioned Sichuan Juxinhe. It says the company had direct involvement. A joint advisory by 13 countries (27 August 2025) describes a partly overlapping set of PRC state-sponsored activity. It links the activity to three China-based companies.
Who they target
Major US telecommunications and internet providers, per MITRE and the US Treasury. The 13-country advisory adds government, transport, lodging and military networks worldwide. Activity is reported in the US, Australia, Canada, New Zealand, the UK, Finland and Poland. The FBI and CISA say call records were taken. They say some private communications of people in government or politics were also taken.
How they usually get in
Mostly known flaws in routers and other edge devices. The advisory says no zero-day flaws have been observed. After getting in, the actors change router settings: access lists, tunnels, accounts and packet capture.
What stands out
The targets are network devices, not computers. The actors modify the devices themselves, including through a container feature on Cisco devices, to stay in. The governments behind the advisory do not adopt a commercial name. Some reporting under similar names may therefore cover different activity.
What to do first
Patch internet-facing routers and firewalls, switch off Cisco Smart Install and lock down device management. Compare every router configuration with its last approved version to find unexpected tunnels, accounts and access list entries.

Names

Public reports use several names for this activity.

Names used for Salt Typhoon
NameWhere it appears
Salt Typhoon MITRE ATT&CK G1045 (no associated group names listed); US Treasury press release of 17 January 2025; FBI notice of 24 April 2025; AA25-239A[1, 2, 4, 5]
OPERATOR PANDA CrowdStrike name; its adversary page lists Salt Typhoon among community identifiers; AA25-239A lists it among partly overlapping names[5]
RedMike AA25-239A; German BfV text[5]
GhostEmperor AA25-239A; German BfV and BND texts[5, 8]
FamousSparrow German BND text, given as an alias of Salt Typhoon[8]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Last modified 31 July 2026

    Describes Salt Typhoon as a People's Republic of China (PRC) state-backed actor, active since at least 2019. Describes it as responsible for compromises of network infrastructure at major US telecoms and internet providers. The page was created 24 February 2025.[1]

  • US Department of the Treasury 17 January 2025

    Sanctioned Sichuan Juxinhe as having direct involvement in the Salt Typhoon intrusions. Said the Ministry of State Security has strong ties to computer network exploitation companies including Sichuan Juxinhe.[2]

  • FBI and CISA 13 November 2024

    Said PRC-affiliated actors compromised networks at multiple telecommunications companies. Said this enabled theft of customer call records and of private communications of a limited number of people in government or political activity.[3]

  • FBI 24 April 2025

    Asked the public for information on PRC-affiliated activity publicly tracked as Salt Typhoon. Listed its earlier statements of 25 October and 13 November 2024.[4]

  • CISA, NSA, FBI and partner agencies (AA25-239A) 27 August 2025

    Described PRC state-sponsored APT actors whose activity partially overlaps with industry reporting on Salt Typhoon and other names. Linked the operations to three China-based companies. Said the agencies are not adopting a commercial name.[5]

  • NCSC-UK 27 August 2025

    Linked three China-based technology companies to a global campaign. Said the activity partially overlaps with campaigns reported under the name Salt Typhoon.

  • Canadian Cyber Centre and FBI Modified 19 June 2025

    Said the actors targeting Canadian telecommunications companies were almost certainly PRC state-sponsored actors, specifically Salt Typhoon.[6]

  • Dutch services MIVD and AIVD 28 August 2025

    Said that with their own intelligence they can confirm part of the US findings. Said that Dutch targets were smaller internet service and hosting providers.[7]

  • German BfV 27 August 2025

    Described Salt Typhoon as a complex APT actor mainly attacking telecommunications. Said it is known under the aliases GhostEmperor and RedMike.

  • NCSC-NZ 2025 (the Cyber Threat Report 2026 repeats it)

    Said the activity, commonly referred to as Salt Typhoon, was undertaken by PRC-based companies affiliated with the PRC Government. Said it was observed in New Zealand.

  • Czech NÚKIB 27 August 2025

    Joined the advisory. Said the activity partially overlaps with the group most commonly tracked as Salt Typhoon. Said there were incidents in seven countries.

  • UK Foreign, Commonwealth and Development Office 9 December 2025

    Recalled the August 2025 exposure of three China-based companies. Said they are linked to the cyber-espionage campaign known as SALT TYPHOON.

Where sources differ

Sources differ on how far the name reaches. MITRE and the US Treasury describe Salt Typhoon as a group active since at least 2019. AA25-239A (27 August 2025) describes operations "since at least 2021". It says its activity only partially overlaps with Salt Typhoon reporting.

The agencies behind AA25-239A say they do not adopt a commercial name and call the actors "APT actors".

The Canadian Cyber Centre, by contrast, says the actors in Canada were almost certainly PRC state-sponsored, "specifically Salt Typhoon".

On other names, the German BfV gives GhostEmperor and RedMike as aliases. The German BND gives GhostEmperor and FamousSparrow. AA25-239A lists OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor as partly overlapping names.

On companies, the US Treasury names one (Sichuan Juxinhe), while AA25-239A and NCSC-UK name three. ESET, which named FamousSparrow, tracks it as its own distinct cluster with loose links to Salt Typhoon.

Who they target

Sectors

  • Major US carriers and ISPsMITRE and the US Treasury say Salt Typhoon compromised network infrastructure at major US telecommunications and internet service providers. The FCC order of 20 November 2025 says Salt Typhoon infiltrated at least eight US communications companies.[1, 2]
  • Call records and law enforcement requestsThe FBI and CISA say actors stole customer call records. They say the actors also copied information subject to US court-ordered law enforcement requests.[3, 4]
  • A limited number of individualsThe FBI and CISA say private communications were compromised of a limited number of people primarily involved in government or political activity.[3]
  • Networks worldwideAA25-239A and NCSC-UK say the activity since at least 2021 has targeted these kinds of infrastructure: telecommunications, government, transportation, lodging and military.[5]
  • Backbone, provider edge and customer edge routersAA25-239A says the actors focus on large backbone routers of major telecommunications providers. It says they also focus on provider edge and customer edge routers. It says they may target edge devices regardless of who owns them.[5]
  • Customer networks behind providersAA25-239A says the actors passively collect packet captures from specific ISP customer networks and use trusted provider connections to pivot into other networks.[5]
  • A Canadian telecommunications companyThe Cyber Centre says three devices of a Canadian telecom company were compromised in mid-February 2025. It says likely Salt Typhoon actors did this.[6]
  • A cluster of activityNCSC-UK says the activity was observed with a cluster in the UK.
  • Smaller internet service and hosting providersMIVD and AIVD say the Dutch targets were smaller providers, not large telecoms, and that the actors had access to their routers.[7]
  • Telecommunications and critical infrastructureNCSC-NZ says the activity was observed in New Zealand.
  • US, Australia, Canada, New Zealand, UK, Finland, PolandNÚKIB lists these as places where incidents were observed.

Regions

  • United StatesPRC-affiliated actors compromised networks at multiple US telecommunications companies, per the FBI and CISA.[3]
  • NetherlandsThe AIVD and MIVD said on 28 August 2025 that the Netherlands was also a target of the Salt Typhoon campaign. The targets were smaller internet service and hosting providers, with access to routers.[7]
  • CanadaThe Cyber Centre says it is aware of malicious activity targeting Canadian telecommunications companies. It says the actors are almost certainly PRC state-sponsored, specifically Salt Typhoon. Three devices of a Canadian telecoms company were compromised in mid-February 2025.[6]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. At least 2019

    Earliest start date given

    MITRE and the US Treasury say Salt Typhoon has been active since at least 2019.[1, 2]

  2. August 2021

    AA25-239A indicator period begins

    AA25-239A describes operations since at least 2021. It lists indicators from August 2021 to June 2025.[5]

  3. 2024

    JumbledPath in use

    MITRE says JumbledPath has been used by Salt Typhoon since at least 2024.

  4. 25 October 2024

    First FBI statement

    The FBI notice of 24 April 2025 lists a statement of this date. It lists it among earlier public statements on Salt Typhoon activity.[4]

  5. 13 November 2024

    FBI and CISA joint statement

    The agencies describe PRC-affiliated actors compromising multiple telecommunications companies.[3]

  6. 3 December 2024

    Hardening guidance

    CISA, NSA, FBI, ACSC, the Canadian Cyber Centre and NCSC-NZ publish guidance for communications infrastructure.[4]

  7. 5 December 2024

    FCC proposal

    The FCC chair proposes requiring telecom carriers to secure their networks after the intrusion.

  8. 17 January 2025

    US sanctions

    The US Treasury sanctions Sichuan Juxinhe for direct involvement in the Salt Typhoon intrusions.[2]

  9. Mid-February 2025

    Canadian telecom devices compromised

    The Cyber Centre says three devices were compromised by likely Salt Typhoon actors using CVE-2023-20198.[6]

  10. 15 April 2025

    Edge router advisory

    The Canadian Cyber Centre publishes an advisory on activity associated with Salt Typhoon targeting edge routers.

  11. 24 April 2025

    FBI asks for tips

    The FBI asks the public for information about the individuals behind Salt Typhoon.[4]

  12. 19 June 2025

    Canadian bulletin

    The Cyber Centre and FBI warn of new Salt Typhoon-related compromises in Canada.[6]

  13. 27 August 2025

    Joint advisory AA25-239A

    13 countries publish the advisory and name three China-based companies.[5]

  14. 28 August 2025

    Dutch statement

    MIVD and AIVD say the Netherlands was also a target.[7]

  15. 20 November 2025

    FCC withdraws its ruling

    The FCC rescinds its January 2025 Declaratory Ruling and withdraws the proposed rules.

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about Salt Typhoon
DateWhoWhat
25 October 2024 FBI and US government partners Public statementNamed in the FBI notice of 24 April 2025 as an earlier public statement on Salt Typhoon activity. The statement itself was not opened.[4]
13 November 2024 FBI and CISA Joint statementSaid PRC-affiliated actors compromised multiple telecommunications companies and stole call records data.[3]
3 December 2024 CISA, NSA, FBI, ACSC, Canadian Cyber Centre, NCSC-NZ GuidanceEnhanced Visibility and Hardening Guidance for Communications Infrastructure.[4]
5 December 2024 US Federal Communications Commission Proposed rulesChair proposed a Declaratory Ruling and rulemaking to require telecom carriers to secure their networks.
15 January 2025 US Federal Communications Commission Declaratory Ruling (FCC 25-9)Concluded that section 105 of the CALEA law requires carriers to secure their networks. Adopted 15 January and released 16 January 2025.
17 January 2025 US Department of the Treasury (OFAC) SanctionDesignated Sichuan Juxinhe Network Technology Co., LTD. for direct involvement in the Salt Typhoon intrusions.[2]
17 January 2025 US Department of State (Rewards for Justice), as cited by Treasury Reward offerReward of up to 10 million US dollars for information on persons acting for a foreign government who attack US critical infrastructure. This is a general offer, not named for Salt Typhoon.[2]
15 April 2025 Canadian Centre for Cyber Security AdvisoryEdge router advisory covering activity associated with Salt Typhoon.
24 April 2025 FBI Public notice seeking tipsAsked for information on PRC-affiliated activity tracked as Salt Typhoon, and repeated the reward offer.[4]
19 June 2025 Canadian Centre for Cyber Security with FBI Threat bulletinReported Salt Typhoon compromises of Canadian telecom devices in mid-February 2025.[6]
27 August 2025 CISA, NSA, FBI, DC3 and agencies of 12 other countries Joint advisory AA25-239ADescribed the techniques, exploited flaws and mitigations, and linked the operations to three China-based companies.[5]
27 August 2025 NCSC-UK Public attribution to companiesLinked three China-based technology companies to the campaign.
27 August 2025 Czech NÚKIB, German BfV, BND and BSI, Japan NPA and National Cybersecurity Office, NCSC-NZ Co-sealed AA25-239AEach agency published or joined the advisory.[5, 8]
27 August 2025 Italian AISE and AISI, Spanish CNI, Finnish SUPO, Polish SKW and AW Co-sealed AA25-239AListed as co-sealing agencies in the advisory; no separate national page was opened.[5]
28 August 2025 Australian Signals Directorate (ACSC) Published AA25-239APublished the advisory on cyber.gov.au.
28 August 2025 Dutch services MIVD and AIVD Public statementSaid they can confirm part of the US findings with their own intelligence.[7]
20 November 2025 US Federal Communications Commission Order on Reconsideration (FCC 25-81)Rescinded the January 2025 Declaratory Ruling and withdrew the accompanying proposed rules.

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Gather Victim Network Information: Network Topology T1590.004

    MITRE says the group uses configuration files from exploited devices. It says the group does this to find upstream and downstream network segments.[1]

Resource Development

  • Develop Capabilities: Malware T1587.001

    MITRE says the group has used custom tooling including JumbledPath.[1]

Initial Access

  • Exploit Public-Facing Application T1190

    MITRE lists CVE-2018-0171 (Cisco Smart Install). AA25-239A says known flaws in edge devices are the main way in. It says no zero-days have been observed.[1, 5]

Execution

  • Deploy Container T1610

    AA25-239A says the actors run commands in an on-box Linux container (Guest Shell) on Cisco devices. It says they do this to stage tools and move sideways.[5]

Persistence

  • Account Manipulation: SSH Authorized Keys T1098.004

    MITRE says the group adds SSH authorized keys on compromised network devices.[1]

  • Create Account T1136

    MITRE says the group creates Linux-level users on compromised devices.[1]

Credential Access

  • Brute Force: Password Cracking T1110.002

    MITRE says the group cracks weakly protected passwords taken from device configuration files.[1, 5]

  • Network Sniffing T1040

    MITRE and AA25-239A say the group captures packets on devices. It aims at login traffic such as TACACS+.[1, 5]

Lateral Movement

  • Remote Services: SSH T1021.004

    MITRE says the group uses compromised switches as the source of SSH connections to other devices. This gets around access control lists.[1]

Collection

  • Data from Configuration Repository: Network Device Configuration Dump T1602.002

    MITRE says the group dumps device configurations to look for credentials.[1]

Command and Control

  • Protocol Tunneling T1572

    MITRE and AA25-239A say the group builds GRE tunnels on devices. The Cyber Centre saw this in Canada in February 2025.[1, 5, 6]

Exfiltration

  • Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol T1048.003

    MITRE says the group sends configuration files out over FTP and TFTP.[1]

Defense Impairment

  • Disable or Modify System Firewall T1686

    MITRE says the group changes access control lists and the loopback address on compromised devices.[1, 5]

  • Disable or Modify Tools: Clear Linux or Mac System Logs T1685.006

    MITRE says the group clears logs such as bash history and auth logs.[1, 5]

Tools and malware

  • JumbledPath Custom malware

    MITRE ATT&CK (software S1206) describes a custom-built utility written in Go, used since at least 2024 for packet capture on remote Cisco devices.[1]

  • STOWAWAY Open source pivoting tool

    AA25-239A says the actors use open source multi-hop pivoting tools such as STOWAWAY. They build chained relays for command and control.[5]

  • Guest Shell Built-in device feature

    AA25-239A says the actors run a Linux container on Cisco devices. They use it to stage tools and process data where monitoring is weak.[5]

  • siet.py Python script

    AA25-239A names this script, run inside Guest Shell, to exploit Cisco Smart Install.[5]

  • TCLproxy.tcl and map.tcl Tcl scripts

    AA25-239A says these were run on Cisco IOS devices where the Tcl shell was available.[5]

  • wodSSHServer Publicly available tool

    AA25-239A gives it as an example of publicly available tooling used by the actors.[5]

  • Embedded Packet Capture Built-in device feature

    AA25-239A says the actors use native packet capture on routers to collect login traffic.[5]

Detection and defense

  1. Patch exposed edge devices

    Patch the flaws AA25-239A lists as exploited first. They are in Cisco IOS XE and Smart Install, Ivanti Connect Secure, and a firewall remote code execution flaw. Keep device software at the vendor recommended version.

    Counters T1190

  2. Switch off Cisco Smart Install

    Disable the Smart Install feature on Cisco devices. AA25-239A and the December 2024 guidance advise this.

    Counters T1190

  3. Lock down device management

    Use SSHv2 only and SNMPv3 only. Restrict management access with access lists. Switch off the web interface and unused ports when not needed.

    Counters T1021.004 T1136

  4. Compare router settings with approved versions

    Pull the running configuration of every network device and check it against the last approved version. Review access lists, local accounts, routes and tunnels for changes.

    Counters T1686 T1572 T1136

  5. Control Guest Shell and containers

    Disable Guest Shell where it is not needed and restrict who can enable it. Send container logs to your central log system.

    Counters T1610

  6. Keep logs off the device

    Send logs to a central system and turn on AAA command accounting. Alert when logs are cleared or logging is switched off.

    Counters T1685.006

  7. Alert on packet capture and TACACS+ changes

    Alert when on-box packet capture or traffic mirroring starts. Alert also when TACACS+ traffic leaves the management network or the TACACS+ server setting changes.

    Counters T1040 T1602.002

  8. Harden stored passwords

    Replace weak or default credentials. Use stronger key encryption for stored secrets so configuration files cannot be cracked.

    Counters T1110.002 T1098.004

What Brandefense can do

  • External Attack Surface Management

    Find which of your routers, VPN gateways and management pages face the internet, so exposed devices can be patched or closed first.

  • Cyber Threat Intelligence

    Follow what governments and MITRE report about this activity. Compare the listed techniques with your own network device controls.

  • Dark Web Monitoring

    Watch for leaked or sold company credentials, since MITRE and AA25-239A describe password cracking and weak or reused credentials on network devices.

Questions

Who is Salt Typhoon?

MITRE ATT&CK describes it as a PRC state-backed actor, active since at least 2019. It says the actor is responsible for compromises at major US telecommunications and internet providers. The US Treasury sanctioned Sichuan Juxinhe in January 2025 for direct involvement in the intrusions.

What did the actors take?

The FBI and CISA say actors stole customer call records. They say the actors compromised private communications of a limited number of people in government or political activity. They also say the actors copied information subject to US court-ordered law enforcement requests.

How do they get in?

AA25-239A says they mostly exploit publicly known flaws in edge devices such as routers, firewalls and VPN gateways. It says no zero-days have been observed. MITRE lists CVE-2018-0171 in Cisco Smart Install.

Is advisory AA25-239A only about Salt Typhoon?

No. It says the activity partially overlaps with reporting under the names Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor. It says the agencies do not adopt a commercial name.

Which companies do governments link to the activity?

The US Treasury sanctioned Sichuan Juxinhe on 17 January 2025. AA25-239A and NCSC-UK name three China-based companies as linked to the operations. They are Sichuan Juxinhe, Beijing Huanyu Tianqiong and Sichuan Zhixin Ruijie.

What should we do first?

Patch exposed network edge devices, switch off Cisco Smart Install and lock down device management. Compare each router configuration with the last approved version to find unexpected tunnels, accounts and access list entries.

In our research

  1. MITRE ATT&CK v20 adds AI abuse and water attacks October 2026
  2. Cyber incidents of 2026: lessons from official reports October 2026
  3. NCSC Annual Review 2025: UK Cyber Threat Findings October 2026
  4. Salt Typhoon: what telecom customers should do October 2026
  5. F5 breach: when your security vendor is hacked October 2026
  6. Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026

Sources

  1. Salt Typhoon, Group G1045 MITRE ATT&CK Supports: Description, active since at least 2019, techniques, page dates, no associated group names
  2. Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise US Department of the Treasury Supports: 17 January 2025 sanction of Sichuan Juxinhe, MSS ties, reward offer
  3. Joint Statement from FBI and CISA on the People's Republic of China (PRC) Targeting of Commercial Telecommunications Infrastructure CISA and FBI Supports: 13 November 2024 statement on stolen call records and communications
  4. FBI Seeking Tips about PRC-Targeting of US Telecommunications (I-042425-2-PSA) FBI, Internet Crime Complaint Center Supports: 24 April 2025 request for tips, earlier statements, reward mention
  5. Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (AA25-239A) CISA with NSA, FBI, DC3 and partner agencies of 12 other countries Supports: Techniques, exploited flaws, three named companies, overlap with Salt Typhoon, co-sealers, mitigations
  6. Cyber threat bulletin: PRC cyber actors target telecommunications companies as part of a global cyberespionage campaign Canadian Centre for Cyber Security with FBI Supports: Salt Typhoon compromise of Canadian telecom devices in February 2025, modified 19 June 2025
  7. Nederlandse providers doelwit van Salt Typhoon Dutch government, MIVD and AIVD Supports: 28 August 2025 Dutch targets, own intelligence confirms part of the US findings
  8. Joint Cybersecurity Advisory, Salt Typhoon Bundesnachrichtendienst (BND), Germany Supports: German intelligence service text, alias list

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Industry

Telecommunications

State-sponsored intrusions, subscriber data theft, SIM swapping and account takeover at telecom providers, and the rules that apply.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Incident

Salt Typhoon telecom intrusions

From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries.

Read more

Glossary term

Critical infrastructure

Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety.

Read more