Salt Typhoon

Chinese state-linked actor (also tracked as Earth Estries, GhostEmperor, FamousSparrow) specializing in telecommunications and critical infrastructure espionage. Responsible for the 2024 compromise of major US telecom providers, including access to lawful intercept systems used by law enforcement.

Key behaviours to watch:

Exploitation of edge devices (Cisco routers, Ivanti VPN, Fortinet) for initial access to carrier networks.
Long-term persistence using GRE/IPsec tunnels, modified SSH keys, and living-off-the-land techniques on network infrastructure.
Targeting of CALEA wiretap systems, call metadata, and communications of government officials.

‍