Salt Typhoon
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.
- ATT&CK ID
- G1045
- Origin
- China
- Weather family
- Typhoon
- Techniques
- 43
- Tools
- 1
Vulnerabilities it has exploited
- CVE-2018-0171 Cisco IOS and IOS XEUnscored · exploited in the wild
- CVE-2023-46805 Ivanti Connect Secure and Policy SecureUnscored · exploited in the wild
- CVE-2024-3400 Palo Alto Networks PAN-OSUnscored · exploited in the wild
Techniques
Reconnaissance
Gather Victim Network InformationActive Scanning
Resource Development
Acquire InfrastructureCompromise InfrastructureEstablish AccountsDevelop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsExploit Public-Facing ApplicationTrusted Relationship
Execution
Command and Scripting InterpreterSoftware Deployment ToolsSystem ServicesDeploy Container
Persistence
Valid AccountsAccount ManipulationCreate AccountCreate or Modify System ProcessModify Authentication Process
Privilege Escalation
Valid AccountsAccount ManipulationCreate or Modify System ProcessAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationIndicator RemovalValid Accounts
Defense Impairment
Modify Authentication ProcessNetwork Boundary BridgingDisable or Modify ToolsDisable or Modify System Firewall
Credential Access
Network SniffingBrute ForceUnsecured CredentialsModify Authentication Process
Discovery
System Network Configuration DiscoveryRemote System DiscoveryNetwork SniffingNetwork Service DiscoverySystem Information Discovery
Lateral Movement
Remote ServicesSoftware Deployment Tools
Collection
Data from Local SystemData from Configuration Repository
Command and Control
Application Layer ProtocolProxyNon-Application Layer ProtocolIngress Tool TransferData EncodingNon-Standard PortProtocol Tunneling
Exfiltration
Automated ExfiltrationExfiltration Over Alternative Protocol
Software
JumbledPath