Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group

According to Silent Push, Salt Typhoon is a Chinese state-backed APT group known for global espionage campaigns against telecoms and ISPs, and it is also tracked as GhostEmperor, FamousSparrow, Earth Estries, and UNC2286. The researchers identified 45 new domains registered between 2020 and 2025 that are linked to Salt Typhoon or closely related China-backed actors, with some dating back to May 2020.

They noted patterns such as ProtonMail addresses paired with gibberish strings and fake registrant identities, used to obfuscate domain registration. Silent Push also observed overlaps with UNC4841, which exploited the Barracuda Email Security Gateway zero-day in 2023, suggesting shared infrastructure and targeting. The findings highlight Salt Typhoon’s long-term infrastructure planning and the attacker’s multi-year strategic approach to its command and control infrastructure.