Início / Grupos de ameaça / Salt Typhoon

Salt Typhoon G1045

🔔 Criar alerta

Atualizado na fonte em 23/09/2026 · Ver no MITRE ATT&CK

3

CVEs associadas

67

Técnicas

1

Malwares e ferramentas

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2024-3400 Crítica · 10.0 KEV Ransomware Palo Alto Networks PAN-OS GlobalProtect: injeção de comandos sem autenticação (CVE-2024-3400)

“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”

CVE-2023-46805 Alta · 8.2 KEV Ransomware Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”

CVE-2018-0171 Crítica · 9.8 KEV Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”

Técnicas por tática

Reconhecimento

T1590.004 Network Topology T1595 Active Scanning

Desenvolvimento de recursos

T1583.003 Virtual Private Server T1584.008 Network Devices T1585.001 Social Media Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.005 Exploits

Acesso inicial

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1199 Trusted Relationship

Execução

T1059.004 Unix Shell T1059.006 Python T1059.008 Network Device CLI T1059.013 Container CLI/API T1072 Software Deployment Tools T1569 System Services T1610 Deploy Container

Persistência

T1078 Valid Accounts T1098.004 SSH Authorized Keys T1136 Create Account T1136.001 Local Account T1543.005 Container Service T1556 Modify Authentication Process

Escalada de privilégios

T1078 Valid Accounts T1098.004 SSH Authorized Keys T1543.005 Container Service T1548.003 Sudo and Sudo Caching

Furtividade

T1027.010 Command Obfuscation T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.009 Clear Persistence T1078 Valid Accounts

Comprometimento de defesas

T1556 Modify Authentication Process T1599 Network Boundary Bridging T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall T1686.002 Network Device Firewall

Acesso a credenciais

T1040 Network Sniffing T1110.001 Password Guessing T1110.002 Password Cracking T1552.001 Credentials In Files T1556 Modify Authentication Process

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1040 Network Sniffing T1046 Network Service Discovery T1082 System Information Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.004 SSH T1072 Software Deployment Tools

Coleta

T1005 Data from Local System T1602.001 SNMP (MIB Dump)T1602.002 Network Device Configuration Dump

Comando e controle

T1071.001 Web Protocols T1071.002 File Transfer Protocols T1090 Proxy T1090.003 Multi-hop Proxy T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1571 Non-Standard Port T1572 Protocol Tunneling

Exfiltração

T1020.001 Traffic Duplication T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malwares e ferramentas

JumbledPathMalwareS1206

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.