Salt Typhoon
Also known as: OPERATOR PANDA, RedMike, GhostEmperor, UNC5807
Salt Typhoon targets the networks that carry everyone else's traffic. By compromising large routers and network edge devices at telecom providers, it gained access to call records and some communications. The 2025 joint advisory notes the activity overlaps with several vendor-tracked groups, so the aliases here are partial overlaps.
- Public attribution
- Publicly attributed by the US government and allied agencies to PRC state-sponsored actors; a 2025 joint advisory links the activity to several China-based companies.
- Active since
- Around 2019
- Targets
- Telecommunications providers and ISPs
- Network backbone, provider-edge and customer-edge routers
- Government and political figures (via telecom data)
Notable campaigns
2024US telecommunications compromises
The FBI and CISA said PRC-affiliated actors stole call records, accessed communications of a limited number of government and political figures, and copied certain information subject to US law enforcement requests made under court orders.
2025Worldwide joint advisory
A multi-country advisory (AA25-239A) detailed exploitation of Ivanti, Palo Alto Networks and Cisco vulnerabilities on network edge devices.
Signature ATT&CK techniques
- T1190Exploit Public-Facing Application
- T1602.002Data from Configuration Repository: Network Device Configuration Dump
- T1040Network Sniffing
- T1098.004Account Manipulation: SSH Authorized Keys
- T1572Protocol Tunneling
- T1599Network Boundary Bridging
- T1110.002Brute Force: Password Cracking
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Patch network edge devices against the known exploited CVEs listed in the advisory, and remove management interfaces from the internet.
- Manage routers only from a dedicated out-of-band network, with MFA and strong, unique credentials.
- Monitor configuration changes, new local accounts, new SSH keys and unexpected tunnels on network devices.
- Use strong (type 8 or better) password hashing on devices so stolen configurations do not reveal passwords.
- Encrypt sensitive communications end to end rather than relying on the carrier network.
Learn and practise on CyberCertPrep
Sources
- MITRE ATT&CK: Salt Typhoon (G1045)
- CISA AA25-239A: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide
- CISA: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
- Joint Statement from FBI and CISA on PRC Targeting of Commercial Telecommunications Infrastructure