Salt Typhoon Cyber Espionage Targeting Telecommunications and Government

Salt Typhoon (also known as RedMike, FamousSparrow, GhostEmperor, and Earth Estries) is a prolific China-nexus advanced persistent threat (APT) group that has conducted high-profile cyber espionage campaigns targeting at least nine major U.S. telecommunications companies, including AT&T, Verizon, and T-Mobile. The group's primary objective is the exfiltration of sensitive intelligence, having successfully accessed call metadata, text messages, and audio recordings from high-profile political figures and government targets. Recent reporting also identifies a new campaign named 'EastWind' targeting Russian government agencies, utilizing cloud-based services and updated backdoors like CloudSorcerer.

The technical tradecraft employed by Salt Typhoon is highly sophisticated, characterized by the exploitation of zero-day vulnerabilities in edge networking equipment (e.g., Barracuda ESG, Cisco IOS XE, Ivanti Connect Secure) and the use of 'living off the land' techniques. The group frequently employs kernel-mode rootkits like Demodex and custom backdoors such as SparrowDoor, Zingdoor, and the SALTWATER/SEASPY/SEASIDE trio. They effectively mask their Command and Control (C2) traffic by abusing legitimate public services including Microsoft Graph, Dropbox, GitHub, and various social media platforms.

This activity represents a critical national security threat due to the group's ability to compromise lawful intercept (wiretap) systems and maintain long-term persistence within core telecommunications infrastructure. Affected sectors include government, information technology, and telecommunications globally, with recent expansions into critical manufacturing and satellite communications (Viasat).