Salt Typhoon
- ID
- G1045
- Source
- attack.mitre.org
- MITRE last modified
- 24 Sep 2026
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.[1][2][3][4][5][6][7][8]
Techniques used (58)
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1020.001 Traffic Duplication
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1027.010 Command Obfuscation
- T1040 Network Sniffing
- T1046 Network Service Discovery
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1059.004 Unix Shell
- T1059.006 Python
- T1059.008 Network Device CLI
- T1059.013 Container CLI/API
- T1070.003 Clear Command History
- T1070.007 Clear Network Connection History and Configurations
- T1070.009 Clear Persistence
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1072 Software Deployment Tools
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1090 Proxy
- T1090.003 Multi-hop Proxy
- T1095 Non-Application Layer Protocol
- T1098.004 SSH Authorized Keys
- T1105 Ingress Tool Transfer
- T1110.001 Password Guessing
- T1110.002 Password Cracking
- T1132.001 Standard Encoding
- T1136 Create Account
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1543.005 Container Service
- T1548.003 Sudo and Sudo Caching
- T1552.001 Credentials In Files
- T1556 Modify Authentication Process
- T1569 System Services
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1583.003 Virtual Private Server
- T1584.008 Network Devices
- T1585.001 Social Media Accounts
- T1587 Develop Capabilities
- T1587.001 Malware
- T1588.002 Tool
- T1588.005 Exploits
- T1590.004 Network Topology
- T1595 Active Scanning
- T1599 Network Boundary Bridging
- T1602.001 SNMP (MIB Dump)
- T1602.002 Network Device Configuration Dump
- T1610 Deploy Container
- T1685 Disable or Modify Tools
- T1685.006 Clear Linux or Mac System Logs
- T1686 Disable or Modify System Firewall
- T1686.002 Network Device Firewall