New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading

Salt Typhoon is described as one of the most persistent and sophisticated cyber threats targeting global critical infrastructure, with activity spanning telecommunications providers, energy networks and government systems, including across the United States. The group is believed to be linked to state-sponsored actors from the People’s Republic of China and has been active since at least 2019, operating under aliases such as Earth Estries, GhostEmperor, and UNC2286.

It uses custom malware and exploits high‑impact vulnerabilities for long‑term access, including DLL sideloading via legitimate antivirus software to deliver payloads, and has delivered a backdoor named SNAPPYBEE, also known as Deed RAT, to Citrix VDA hosts.

The intrusion reportedly began with exploitation of a Citrix NetScaler Gateway appliance in the first week of July 2025, with subsequent lateral movement to VDA hosts and the use of LightNode VPS endpoints for command‑and‑control over HTTP and an unidentified TCP protocol. According to Darktrace, activity observed in a European telecoms organisation aligns with Salt Typhoon’s tactics and C2 patterns, including DLL sideloading and stealth through trusted software.