Threat actor
Salt Typhoon
China
Tracked by CyberSIXT since 27 Aug 2025
- Articles · all time
- 25
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 5
25 articles from 1 outlet; the latest 38 days ago.
- Article
- Research report
Show as table
Names and sources
- GhostEmperor
- Named by CyberSIXT coverage
- FamousSparrow
- Named by Malpedia · ghostemperor
- GhostEmperor
- Named by Malpedia · ghostemperor
- OPERATOR PANDA
- Named by Malpedia · ghostemperor
- RedMike
- Named by Malpedia · ghostemperor
- Salt Typhoon
- Named by Malpedia · ghostemperor
- UNC2286
- Named by Malpedia · ghostemperor
- FamousSparrow
- Named by Microsoft · Salt Typhoon
All 19 names
- GhostEmperor
- Named by Microsoft · Salt Typhoon
- OPERATOR PANDA
- Named by Microsoft · Salt Typhoon
- Salt Typhoon
- Named by Microsoft · Salt Typhoon
- FamousSparrow
- Named by MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- GhostEmperor
- Named by MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- OPERATOR PANDA
- Named by MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- RedMike
- Named by MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- Salt Typhoon
- Named by MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- UNC2286
- Named by MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- Salt Typhoon
- Named by MITRE ATT&CK® · G1045
- 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Salt Typhoon)
- origin
- China (Microsoft · Salt Typhoon)
- origin
- China (MISP Galaxy · 3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1045
Tactics pending refresh
- T1005
- Data from Local System
- T1016
- System Network Configuration Discovery
- T1018
- Remote System Discovery
- T1020.001
- Traffic Duplication
- T1021.001
- Remote Desktop Protocol
- T1021.004
- SSH
- T1027.010
- Command Obfuscation
- T1040
- Network Sniffing
- T1046
- Network Service Discovery
- T1048.003
- Exfiltration Over Unencrypted Non-C2 Protocol
- T1059.004
- Unix Shell
- T1059.006
- Python
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
Also mentioned alongside Salt Typhoon (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Salt Typhoon.
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCVSS9.8CriticalExploited99%EPSS0articles
- Chinese Hackers Target Latin American Governments With New MalwareDark Reading
- China-Linked Hackers Target Latin America With SparroWocky BackdoorInfosecurity
- China-Aligned FamousSparrow Deploys SparroWocky Across Latin AmericaThe Hacker News
- Tropical Blend: Cyber & Politics Ramp Up Across Latin AmericaDark Reading
- Security Affairs Round 97 Covers JDownloader Hacked, TrickMo RiseSecurity Affairs
- Apple, Meta Warn Canada's Encryption Bill Could Lead to BackdoorsSecurityWeek
- Salt Typhoon hits Azerbaijani energy firm via Exchange exploitSecurityWeek
- FamousSparrow hits Azerbaijani oil firm via Exchange exploitsSecurity Affairs
- Chinese hackers hit Azerbaijan energy firm with multi wave attackThe Hacker News
- FamousSparrow hits Azerbaijani oil firm with DLL sideloadDark Reading
- US defence contractors warned of nation state edge device attacksInfosecurity
- Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defensesSecurity Affairs
The latest 12 are listed. See all 31 articles in the timeline.
Research reports
- Darktrace Malware Analysis: Unpacking SnappyBeeOrkl.eu · 10 Oct
- Beware the SparroWock: The backdoor that bites, the commands that catchOrkl.eu · 23 Sep
- eset-apt-activity-report-q2-2025-q3-2025.pdfOrkl.eu · 20 Jun
- RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications ProvidersOrkl.eu · 23 Feb 2025
- DOC-408945A1.pdfOrkl.eu · 23 Feb 2025