Home / Threat actors / Salt Typhoon

Salt Typhoon G1045

🔔 Create alert

Updated at source on Sep 23, 2026 · View on MITRE ATT&CK

3

associated CVEs

67

Techniques

1

Malware and tools

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2024-3400 Critical · 10.0 KEV Ransomware Palo Alto Networks PAN-OS Command Injection Vulnerability

“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”

CVE-2023-46805 High · 8.2 KEV Ransomware Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”

CVE-2018-0171 Critical · 9.8 KEV Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”

Techniques by tactic

Reconnaissance

T1590.004 Network Topology T1595 Active Scanning

Resource Development

T1583.003 Virtual Private Server T1584.008 Network Devices T1585.001 Social Media Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.005 Exploits

Initial Access

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1199 Trusted Relationship

Execution

T1059.004 Unix Shell T1059.006 Python T1059.008 Network Device CLI T1059.013 Container CLI/API T1072 Software Deployment Tools T1569 System Services T1610 Deploy Container

Persistence

T1078 Valid Accounts T1098.004 SSH Authorized Keys T1136 Create Account T1136.001 Local Account T1543.005 Container Service T1556 Modify Authentication Process

Privilege Escalation

T1078 Valid Accounts T1098.004 SSH Authorized Keys T1543.005 Container Service T1548.003 Sudo and Sudo Caching

Stealth

T1027.010 Command Obfuscation T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.009 Clear Persistence T1078 Valid Accounts

Defense Impairment

T1556 Modify Authentication Process T1599 Network Boundary Bridging T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall T1686.002 Network Device Firewall

Credential Access

T1040 Network Sniffing T1110.001 Password Guessing T1110.002 Password Cracking T1552.001 Credentials In Files T1556 Modify Authentication Process

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1040 Network Sniffing T1046 Network Service Discovery T1082 System Information Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.004 SSH T1072 Software Deployment Tools

Collection

T1005 Data from Local System T1602.001 SNMP (MIB Dump)T1602.002 Network Device Configuration Dump

Command and Control

T1071.001 Web Protocols T1071.002 File Transfer Protocols T1090 Proxy T1090.003 Multi-hop Proxy T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1571 Non-Standard Port T1572 Protocol Tunneling

Exfiltration

T1020.001 Traffic Duplication T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malware and tools

JumbledPathMalwareS1206

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.