🇨🇳 Salt Typhoon¶
Threat-actor battle card · maintained from public sources · last updated 2026-10-17 · also known as RedMike, OPERATOR PANDA, GhostEmperor, UNC5807
Overview¶
Salt Typhoon is a PRC state-sponsored espionage actor operating globally since at least 2021, subject of joint advisory AA25-239A (Aug 2025). Linked to Chinese contractors (Sichuan Juxinhe Network Technology, sanctioned by US Treasury Sep 2025) that service the PLA and Ministry of State Security. By August 2025 the FBI confirmed 200+ organisations in 80+ countries compromised; 600+ organisations globally notified of adversary interest in their systems. Allied spy agencies (CISA, FBI, NSA, and Five Eyes partners) publicly attributed three Chinese tech companies as infrastructure providers in 2025. In 2026 the campaign expanded into South American telecom carriers with new implants TernDoor, PeerTime, and BruteEntry. FBI director confirmed in February 2026 that threats from Salt Typhoon are "still very much ongoing" despite US sanctions on Sichuan Juxinhe. US Senate Commerce Committee called out AT&T and Verizon for non-cooperation as late as February 2026; US agencies have stated they cannot confirm the adversary has been fully evicted from US telecom networks as of mid-2026.
Tradecraft¶
- Exploits vulnerabilities in telecom backbone routers — provider-edge and customer-edge devices that lack EDR-class monitoring.
- Modifies router firmware and configurations for persistent, stealthy, long-term access; firmware integrity checks rarely implemented at the provider level.
- Objective: tap communications and movement data of high-value intelligence targets via ISP, telecom, and travel-sector intrusions.
- Long dwell times (months to years); highly selective data collection rather than bulk exfiltration.
- New 2026 implants — TernDoor (Windows backdoor, derived from the CrowDoor/SparrowDoor lineage), PeerTime (Linux backdoor using BitTorrent for C2), and BruteEntry (edge-device brute-force/ORB proxy tool targeting Postgres, SSH, Tomcat) — observed in South American carrier infrastructure. Attribution note: Cisco Talos tracks this cluster as UAT-9244, assessed with high confidence as China-nexus and "closely associated with FamousSparrow" — not confirmed as Salt Typhoon proper. The Hacker News
- New backdoor, Sep 2026: ESET reports FamousSparrow deployed SparroWocky — a modular C++ backdoor (arbitrary file execution, TCP proxying, system recon, file exfiltration, periodic screenshots) that has replaced the group's long-standing SparrowDoor implant — against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, first observed from at least August 2025. ESET assesses ~90% of the group's mid-2025–2026 telemetry-observed targets were in Latin America, and links the regional pivot to Chinese interest in tracking Latin American governments' responses to US economic pressure on China. ESET WeLiveSecurity · BleepingComputer
Notable victims¶
- US: AT&T, Verizon, T-Mobile, Spectrum (Charter), Lumen, Consolidated Communications, Windstream — 9 US telecoms confirmed by FBI (Aug 2025).
- Data/cable: Digital Realty (data center) and Comcast (cable/broadband) assessed as likely victims.
- Satellite: Viasat (US satellite comms) confirmed June 2025.
- Global (6 continents): UK telecom affiliate, South African provider, Italian ISP, Thai telecom, Myanmar's Mytel network — per Recorded Future mapping.
- Latin America (government, Sep 2026): Government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela targeted with the SparroWocky backdoor — attributed to FamousSparrow, publicly linked to but not confirmed identical to Salt Typhoon (see Assessment). ESET WeLiveSecurity
- US government: NSA, DOD, and intelligence-community communications reportedly intercepted over the 2022–2025 campaign.
- Scope: 600+ organisations globally notified by CISA/FBI of adversary interest in their systems; actual confirmed compromise narrower.
Assessment¶
A strategic counter-intelligence threat rather than a smash-and-grab. The 2022–2025 US telecom campaign was described by US officials as among the worst intelligence failures in American history. Defense centres on edge-router firmware integrity, configuration monitoring, end-of-life device replacement, and end-to-end encrypted communications for sensitive material. Not victim-enumerated by DLS — tracked qualitatively on the APT watchlist. Congressional concern (Cantwell letter Feb 2026) suggests networks may remain partially compromised.
Attribution is less settled than the single "Salt Typhoon" name implies (Sep 2026). Microsoft's September 2024 reporting clustered Salt Typhoon, GhostEmperor, and FamousSparrow together, and this card's aliases follow that convention. ESET, which discovered and names FamousSparrow, disputes the merge: it tracks FamousSparrow as "its own distinct cluster with loose links to" Salt Typhoon, and separately says it tracks GhostEmperor apart from FamousSparrow despite some infrastructure overlap, suggesting the links may instead reflect a shared third-party tooling supplier (a "digital quartermaster") rather than one actor. Cisco Talos similarly describes the South American UAT-9244 cluster (TernDoor/PeerTime/BruteEntry, see Tradecraft) only as "closely associated with" FamousSparrow, not as confirmed Salt Typhoon activity. Treat sub-cluster attributions (FamousSparrow, UAT-9244, GhostEmperor) as China-nexus and publicly linked to Salt Typhoon, not as proven identical to it. ESET WeLiveSecurity — "You will always remember this as the day you finally caught FamousSparrow"
UK regulatory response (July 2026): The UK government developed a new telecoms security code specifically in response to the Salt Typhoon campaign; however, following lobbying coordinated by TechUK (the UK tech industry body), the code was weakened before adoption. Dropped provisions include: (1) treating all incoming signalling traffic as untrusted by default; (2) mandatory monthly equipment restarts that would flush memory-only malware from compromised devices; (3) accelerated timeline for securing broad-access service accounts (deferred from end-2028 to end-2029). Parliament has a 40-day scrutiny window before the weakened code takes effect (effective mid-July 2026). These are precisely the controls designed to detect and remove the persistent, memory-resident access methodology Salt Typhoon uses — their removal represents a significant defensive regression on an active, confirmed intrusion vector. The Record
Sources¶
- CISA joint advisory AA25-239A — Countering Chinese State-Sponsored Actors
- TechCrunch — Salt Typhoon: everywhere that's been hit (Mar 2026 tracker)
- Nextgov/FCW — US agencies assessed Chinese telecom hackers likely hit data centers and residential ISPs
- US Senate Commerce Committee press release — experts agree US networks remain vulnerable
- Vectra AI — Salt Typhoon TTPs, detection, defense
- Huntress — Salt Typhoon threat actor profile
- The Record — UK weakens telecoms defenses after industry lobbying (July 2026)
- Global Cyber Alliance — Salt Typhoon Across the Internet (Dec 2025 comprehensive mapping)
- CyberScoop — FBI: Threats from Salt Typhoon are 'still very much ongoing' (Feb 2026)
- Congress.gov CRS — Salt Typhoon Hacks and Federal Response Implications
- The Hacker News — China-linked hackers use TernDoor, PeerTime, BruteEntry against South American telcos (Mar 2026, Cisco Talos research)
- ESET WeLiveSecurity — Beware: SparroWocky backdoor bites, commands, catch (Sep 2026)
- ESET WeLiveSecurity — You will always remember this as the day you finally caught FamousSparrow (Mar 2025, attribution/clustering methodology)
- BleepingComputer — Chinese hackers use SparroWocky malware in govt espionage attacks (Sep 2026)
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
No attacks recorded yet.