ChinaAttributedPRC state-sponsoredEspionageActive 2019 – 2025Salt Typhoon
Also known asEarth Estries · GhostEmperor · OPERATOR PANDA
Summary
PRC state-sponsored espionage actor behind the compromise of major telecommunications providers' network infrastructure, described by the 13-nation joint advisory AA25-239A (Aug 2025): exploitation of edge devices — Cisco IOS XE (CVE-2023-20198/20273), Ivanti (CVE-2023-46805/CVE-2024-21887), Palo Alto PAN-OS (CVE-2024-3400) — router configuration changes, GRE tunnels and packet capture to collect communications, with targeting of telecommunications, government, transportation, lodging and military infrastructure worldwide. The advisory notes the activity 'partially overlaps' industry names including Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor; Trend Micro tracks it as Earth Estries. Contractor companies including Sichuan Juxinhe Network Technology provide services to multiple PLA and MSS units. Microsoft also maps FamousSparrow into this cluster, but ESET, which named FamousSparrow, tracks it separately — see the FamousSparrow record.
Attribution
Contractor firms serve PLA and MSS units
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- NSA, CISA, FBI and partners (AA25-239A) (Government, 2025-08-27)
Contractor firms incl. Sichuan Juxinhe serve multiple PLA and MSS units - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
PRC state-backed actor
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Canadian telecommunications provider — Cisco IOS XE CVE-2023-20198, configuration theft and GRE tunnelASSESSED | 2025-02 | Canada | Telecommunications | Canadian Centre for Cyber Security and FBI (2025-06) — "likely Salt Typhoon actors" |
| RedMike — Cisco IOS XE exploitation of telecoms and universities | 2024-12 – 2025-01 | USA, South Africa, Italy, Thailand, Myanmar, Argentina, Bangladesh, Indonesia, Malaysia, Mexico, Netherlands, Vietnam | Telecommunications, Academia | Recorded Future Insikt Group (2025-02-13) |
| Global Telecom Backbone Compromise | 2021 – ongoing | USA, UK, Australia, Canada, New Zealand, Global | Telecommunications, Government, Transportation, Lodging, Military infrastructure | NSA/CISA/FBI + partners AA25-239A (2025-08-27; IC3 copy) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 21
| Reconnaissance1 | T1590.004Network Topology |
|---|---|
| Initial Access1 | T1190Exploit Public-Facing Application |
| Execution1 | T1059.008Network Device CLI |
| Persistence5 | T1078Valid AccountsT1542.005TFTP BootT1098.004SSH Authorized KeysT1136Create AccountT1543.005Container Service |
| Stealth1 | T1070.009Clear Persistence |
| Defense Impairment2 | T1685.006Clear Linux or Mac System LogsT1686.002Network Device Firewall |
| Credential Access3 | T1556Modify Authentication ProcessT1040Network SniffingT1110.002Password Cracking |
| Lateral Movement1 | T1021.001Remote Desktop Protocol |
| Collection3 | T1560Archive Collected DataT1602.002Network Device Configuration DumpT1602.001SNMP (MIB Dump) |
| Exfiltration2 | T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolT1020.001Traffic Duplication |
| Command and Control1 | T1071.001Web Protocols |
Malware and tools 3
| Name | Description | Platform |
|---|---|---|
| GhostSpider | Backdoor | Windows |
| SNAPPYBEE (Deed RAT) | Modular Backdoor | Windows |
| JumbledPath | Malware | Network Devices |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2023-20198 | 10 | Cisco IOS XE Web UI (KEV 2023-10-16) |
| CVE-2024-3400 | 10 | Palo Alto PAN-OS GlobalProtect — OS command injection (KEV 2024-04-12) |
| CVE-2018-0171 | 9.8 | Cisco Smart Install (KEV 2021-11-03) |
| CVE-2024-21887 | 9.1 | Ivanti Connect Secure / Policy Secure — web-component command injection (KEV 2024-01-10) |
| CVE-2023-46805 | 8.2 | Ivanti Connect Secure / Policy Secure — authentication bypass (KEV 2024-01-10) |
| CVE-2023-20273 | 7.2 | Cisco IOS XE Privilege Escalation (KEV 2023-10-23) |
Highest CVSS first.
Infrastructure patterns
- Backbone, provider-edge and customer-edge routers used to pivot into other networks (CISA et al., 2025)
- Custom SFTP clients move files to staging hosts before exfiltration (CISA et al., 2025)
- SSH servers and non-standard ports opened on network devices for remote access (CISA et al., 2025)
Reporting and advisories 5
- CISA / NSA / FBI (12 nations)
AA25-239A — Countering PRC Salt Typhoon State-Sponsored Actors (Aug 2025) - FBI / CISA
Joint Statement on the PRC's Targeting of Commercial Telecommunications Infrastructure (Nov 2024) - Recorded Future Insikt Group
RedMike (Salt Typhoon) Exploits Vulnerable Devices (13 Feb 2025) - MITRE ATT&CK
Salt Typhoon (G1045) group profile - Canadian Centre for Cyber Security / FBI
PRC cyber actors target telecommunications companies (Salt Typhoon in Canada, Jun 2025)