APT Explorer

All actors

Salt Typhoon

Also reported as GhostEmperor, FamousSparrow, UNC2286, Earth Estries, RedMike and 2 other names. Linked to China by four sources.

Reports
76
Last reported
Known CVEs
86
Techniques in ATT&CK
14
Origin
China
ID
G1045
Sources
ATT&CKMISPETDAMalpediaMicrosoft
Merge evidence
19 alias matches

Reports per quarter

Dated reports, 2021 Q3 to 2026 Q3.

Techniques seen in the last two years

Show all 94 techniques Show fewer

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

CVEs named in reports

Show all 86 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Beware the SparroWock: The backdoor that bites, the commands that catch

    publisher's date ESET Research ORKLESET

    Archived copy on ORKL Details

  2. SilkParasite: Tracking a China-Nexus APT Across Central Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. eset-apt-activity-report-q4-2025-q1-2026.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. UAT-8302 and its box full of malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Salt Typhoon: A Wake-up Call for Critical Infrastructure

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Salt Typhoon, GhostEmperor - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  7. ShadowPad (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  8. Salt Typhoon, GhostEmperor - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  9. FBI seeks help to unmask Salt Typhoon hackers behind telecom breaches

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. US sanctions Chinese firm, hacker behind telecom and Treasury hacks

    date ORKL added it ORKL

    Archived copy on ORKL Details

Show all 76 reports Show fewer

  1. Chinese hackers breached T-Mobile's routers to scope out network

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. White House links ninth telecom breach to Chinese hackers

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. Chinese group accused of hacking Singtel in telecom attacks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. NSA: Volt Typhoon was ‘not successful’ at persisting in critical infrastructure

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. What Should the US Do About Salt Typhoon?

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. China Admitted to Volt Typhoon Cyberattacks on US Critical Infrastructure: Report

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. Cyber incident board’s Salt Typhoon review to begin within days, CISA leader says

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. Chinese Hackers Infiltrate U.S. Internet Providers in Cyber Espionage Campaign

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. At least 8 US telcos, dozens of countries impacted by Salt Typhoon breaches, White House says

    date ORKL added it ORKL

    Archived copy on ORKL Details

  11. Chinese hackers also breached Charter and Windstream networks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  12. US agencies confirm Beijing-linked telecom breach involving call records of politicians, wiretaps

    date ORKL added it ORKL

    Archived copy on ORKL Details

  13. You will always remember this as the day you finally caught FamousSparrow

    date ORKL added it ORKL

    Archived copy on ORKL Details

  14. IT threat evolution Q3 2021 - RedPacket Security

    date ORKL added it ORKL

    Archived copy on ORKL Details

  15. AT&T, Verizon reportedly hacked to target US govt wiretapping platform

    date ORKL added it ORKL

    Archived copy on ORKL Details

  16. Chinese hackers breached National Guard to steal network configurations

    date ORKL added it ORKL

    Archived copy on ORKL Details

  17. Canada says Salt Typhoon hacked telecom firm via Cisco flaw

    date ORKL added it ORKL

    Archived copy on ORKL Details

  18. Telecom giant Viasat breached by China's Salt Typhoon hackers

    date ORKL added it ORKL

    Archived copy on ORKL Details

  19. T-Mobile confirms it was hacked in recent wave of telecom breaches

    date ORKL added it ORKL

    Archived copy on ORKL Details

  20. China Protests US Sanctions for Its Alleged Role in Hacking, Complains of Foreign Hacker Attacks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  21. Cobalt Strike (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  22. Treasury Sanctions China-based Hacker Involved in the Compromise of Sensitive U.S. Victim Networks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  23. Salt Typhoon: An Analysis of Vulnerabilities Exploited by this State-Sponsored Actor

    date ORKL added it ORKL

    Archived copy on ORKL Details

  24. UAT-9244 targets South American telecommunication providers with three new malware implants

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. новый модульный бэкдор в госсекторе — Анализ Solar 4RAYS

    Malpedia library date ORKL

    Archived copy on ORKL Details

  26. APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  27. eset-apt-activity-report-q2-2025-q3-2025.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. Will the Real Salt Typhoon Please Stand Up?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. State Secrets for Sale: More Leaks from the Chinese Hack-for-Hire Industry

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices - Censys

    Malpedia library date ORKL

    Archived copy on ORKL Details

  33. UAT-5918 targets critical infrastructure entities in Taiwan

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. DOC-408945A1.pdf

    date ORKL added it ORKL

    Archived copy on ORKL Details

  36. Weathering the storm: In the midst of a Typhoon

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. RedMike Cyber Attack on Cisco Devices in Telecommunications

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers

    file creation date ORKL

    Archived copy on ORKL Details

  39. ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

    Malpedia library date ORKL

    Archived copy on ORKL Details

  40. JSAC2025_1_5_leon-chang_theo-chen_en.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. Breaking Down Earth Estries Persistent TTPs in Prolonged Cyber Operations

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. Tropic Trooper spies on government entities in the Middle East

    Malpedia library date ORKL

    Archived copy on ORKL Details

  44. The Return of Ghost Emperor’s Demodex

    Malpedia library date ORKL

    Archived copy on ORKL Details

  45. The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. PowerPoint 簡報

    Malpedia library date TeamT5 ORKL

    Archived copy on ORKL Details

  47. Modern Asia APT groups TTPs

    file creation date Kaspersky ORKL

    The link to Mirror on Box failed its last check. Mirror on Box Details

  48. Sequel: Gifts from Tropical Pirates - Who is the Sender? Look for the Attacker Group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. deep analysis of Xiangoop Loader and EntryShell payload

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. Cyber Soft Power | China's Continental Takeover

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. Earth Estries Targets Government, Tech for Cyberespionage

    Malpedia library date ORKL

    Archived copy on ORKL Details

  52. Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. NCSC-MAR-SparrowDoor.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  54. eset_threat_report_t32021.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. eset_threat_report_t32021

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  56. MoonBounce: the dark side of UEFI firmware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  57. MoonBounce_ the dark side of UEFI firmware _ Securelist

    date in the CCS '25 data Kaspersky ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  58. MoonBounce- the dark side of UEFI firmware

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  59. GhostEmperor_technical-details_PDF_eng

    Malpedia library date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  60. GhostEmperor- From ProxyLogon to kernel mode

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  61. GhostEmperor: From ProxyLogon to kernel mode

    Malpedia library date ORKL

    Archived copy on ORKL Details

  62. FamousSparrow_ A suspicious hotel guest _ WeLiveSecurity

    date in the CCS '25 data ESET ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  63. FamousSparrow- A suspicious hotel guest

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  64. FamousSparrow: A suspicious hotel guest

    Malpedia library date ORKL

    Archived copy on ORKL Details

  65. GhostEmperor: Chinese-speaking APT targets high-profile victims using unknown rootkit

    Malpedia library date Kaspersky ORKLCCS '25 data

    Archived copy on ORKL Details

  66. GhostEmperor- Chinese-speaking APT targets high-profile victims using unknown rootkit

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.