{
  "id": "salt-typhoon",
  "name": "Salt Typhoon",
  "aliases": [],
  "domain": "cyber",
  "country": "CHN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments.",
  "specs": [
    {
      "k": "sponsor",
      "v": "People's Republic of China state-backed",
      "src": [
        "mitre-g1045"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2019,
      "src": [
        "mitre-g1045"
      ],
      "conf": "medium",
      "note": "At least 2019"
    },
    {
      "k": "attack_id",
      "v": "G1045",
      "src": [
        "mitre-g1045"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments.",
      "src": [
        "mitre-g1045"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 58,
      "src": [
        "mitre-g1045"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "JumbledPath",
      "src": [
        "mitre-g1045"
      ],
      "conf": "high",
      "note": "1 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1045)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/salt-typhoon.html",
  "sources": {
    "mitre-g1045": {
      "title": "Salt Typhoon, Group G1045",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1045/",
      "published": "2026-09-23",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}