D
CyberChina

Salt Typhoon

State-sponsored cyber threat groupTrackedPending verification
CyberCHN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
ProliferationOrigin country only
Active since2019At least 2019Med[1]
MITRE ATT&CK IDG1045High[1]
Capabilities
ATT&CK techniques used58ATT&CK v20.1High[1]
Malware and toolsJumbledPath1 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorPeople's Republic of China state-backedHigh[1]
TargetsSalt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments.Med[1]
Notes
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments. Salt Typhoon has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). Salt Typhoon has targeted and leveraged public facing network edge devices to gain access to victim environments.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
China
Sources
  1. Salt Typhoon, Group G1045, MITRE ATT&CK
    Published/updated 2026-09-23 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1045)