FORENSIA

THREAT_ACTOR · G1045

Salt Typhoon

Also known as: Salt Typhoon

Profile

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).

MITRE ATT&CK ↗

Techniques

14 ATT&CK techniques attributed to this actor.

T1021.004 SSHT1040 Network SniffingT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1098.004 SSH Authorized KeysT1110.002 Password CrackingT1136 Create AccountT1190 Exploit Public-Facing ApplicationT1572 Protocol TunnelingT1587.001 MalwareT1588.002 ToolT1590.004 Network TopologyT1602.002 Network Device Configuration DumpT1685.006 Clear Linux or Mac System LogsT1686 Disable or Modify System Firewall

Software

1 malware/tools attributed to this actor.

JumbledPath

Related corpus activity

1,877 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Salt Typhoon.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2023-52271cveransomware853
cve-2013-3307cve—852
cve-2018-8007cve—851
cve-2026-0740cve—851
cve-2025-61155cveransomware853
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2025-2492cve—852
cve-2026-1969cve—851
cve-2025-34085cve—851
cve-2025-7852cve—851
cve-2025-23304cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2016-5681cve—852
cve-2025-11837cve—852
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2022-47945cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2026-4368cveransomware851
cve-2021-29441cve—851
cve-2026-3844cve—851
cve-2025-12057cve—851
cve-2025-7443cve—851
cve-2025-1055cveransomware853

Showing the top 30 by severity of 1,877.