Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure

Cybersecurity researchers at Silent Push have uncovered a sophisticated Chinese espionage operation linking two prominent threat actors, Salt Typhoon and UNC4841, revealing infrastructure used to target government and corporate networks across more than 80 countries, according to Silent Push.

The study flags 45 malicious domains dating back to 2020, tied to a network of command and control infrastructure built around domain registration patterns and WHOIS data, with multiple domains registered using ProtonMail addresses under fake personas. The oldest identified domain, onlineeylity[.]com, was registered by a “Monica Burch” persona over five years ago, illustrating long-term operational security.

Salt Typhoon, which is directed by China’s Ministry of State Security and known by aliases including “GhostEmperor,” “FamousSparrow,” and “Earth Estries,” reportedly infiltrated at least nine major U.S. telecommunications companies in 2024 and targeted telecom infrastructure in over 80 countries, focusing on technical exploitation rather than social engineering.

The two groups share infrastructure and coordination signals, including nine domains associated with UNC4841 and overlapping registration patterns and name servers, suggesting either direct coordination or that both designations refer to different phases of a single Chinese intelligence program.

Salt Typhoon’s toolset includes Demodex, Snappybee, and Ghostspider backdoors, and the campaign highlights a broader pattern of zero-day and previously unknown vulnerabilities being exploited against public-facing servers, including connections to telecommunications and government targets.