45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage

Threat hunters have uncovered 45 previously unreported domains tied to China-linked actors Salt Typhoon and UNC4841, with activity traced back to May 2020, according to Silent Push. The analysis notes that the oldest registration appears in May 2020, and the oldest domain in the archive, onlineeylity[.]com, was registered on 19 May 2020 by a persona claiming to reside in Los Angeles.

Three Proton Mail addresses were used to register as many as 16 domains, while IP addresses linked to the domains show a mix of high-density and low-density hosts, the earliest low-density activity dating to October 2021. Salt Typhoon has been active since 2019 and is believed to be operated by China’s Ministry of State Security, sharing overlaps with groups such as Earth Estries and GhostEmperor and with UNC5847. The infrastructure overlaps with UNC4841, noted for its Barracuda ESG zero-day exploitation (CVE-2023-2868, CVSS 9.8).