006.1: SALT TYPHOON

Episode Description:

This episode of The IntrusionsinDepth Podcast released on March 15, 2025, explores the Chinese hacking group Salt Typhoon, a sophisticated cyber-espionage outfit linked to the Ministry of State Security that infiltrated nine U.S. telecom companies and the Treasury by exploiting vulnerabilities in Cisco and BeyondTrust systems. The host traces the group’s evolution from its broad 2019 attacks on Southeast Asia to its refined 2023-2025 campaigns, wielding custom malware like Ghost Spider to steal sensitive data from telecoms, governments, and tech sectors worldwide. With aliases like Ghost Emperor and UNC2286, Salt Typhoon’s history builds on decades of Chinese cyber operations—shifting from the PLA’s early economic theft to the MSS’s strategic espionage—culminating in recent breaches exposing D.C.-area VIP calls and unclassified Treasury documents. The U.S. response of symbolic sanctions on a Chinese firm and an MSS-affiliated hacker underscores the ongoing challenges with groups like this.

Main Topics Discussed:

1. Who is Salt Typhoon?

* Known by aliases like Ghost Emperor and UNC2286, they’ve been active since 2019, tied to China’s MSS.

* Targets include telecoms, governments, and tech globally, with a focus on espionage.

2. History of Chinese Cyber Attacks

* Early attacks (2003-2010s) by the PLA stole tech secrets, like Operation Aurora against Google.

* Modern APTs like Salt Typhoon showing more refined, widespread operations.

3. Salt Typhoon’s Campaigns

* Early hits (2019-2022) targeted Southeast Asia; later ones (2023-2025) hit U.S. telecoms and Treasury.

* Malware like Ghost Spider evolved, using clever tricks to stay hidden and adaptable.

4. U.S. Attacks & Response

* Recent breaches exposed D.C.-area VIP calls and Treasury data via Cisco and BeyondTrust flaws.

* U.S. countered with symbolic sanctions on a Chinese firm and hacker, Yin Jinping, but the threat persists.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://blog.polyswarm.io/salt-typhoon-targets-telecoms-with-ghostspider?

* https://www.npr.org/2024/12/17/nx-s1-5223490/text-messaging-security-fbi-chinese-hackers-security-encryption

* https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf

* https://techcrunch.com/2024/10/13/meet-the-chinese-typhoon-hackers-preparing-for-war/

* https://mashable.com/article/salt-typhoon-breach-att-verizon-clear

* https://techcrunch.com/2024/12/04/fbi-recommends-encrypted-messaging-apps-combat-chinese-hackers/

* https://techcrunch.com/2024/10/07/the-30-year-old-internet-backdoor-law-that-came-back-to-bite/

* https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b

* https://www.reuters.com/technology/cybersecurity/us-adds-9th-telcom-list-companies-hacked-by-chinese-backed-salt-typhoon-2024-12-27/

* https://therecord.media/nine-us-companies-hacked-salt-typhoon-china-espionage

* https://en.wikipedia.org/wiki/Ministry_of_State_Security_(China)

* https://en.wikipedia.org/wiki/2010%E2%80%932012_killing_of_CIA_sources_in_China?

* https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/

* https://www.justice.gov/opa/pr/member-sophisticated-china-based-hacking-group-indicted-series-computer-intrusions-including

* https://cloud.google.com/blog/topics/threat-intelligence/chinese-espionage-tactics/

* https://www.fbi.gov/news/stories/chinese-hackers-charged-in-equifax-breach-021020

* https://en.wikipedia.org/wiki/Operation_Fox_Hunt

* https://en.wikipedia.org/wiki/Salt_Typhoon

* https://www.theguardian.com/us-news/2021/oct/27/us-bans-china-telecom-from-operating-over-national-security-concerns

* https://www.theguardian.com/technology/2020/jan/21/amazon-boss-jeff-bezoss-phone-hacked-by-saudi-crown-prince

* https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/analyzing-salt-typhoon-telecom-attacker/

* https://www.crowdstrike.com/en-us/blog/an-analysis-of-lightbasin-telecommunications-attacks/

* https://www.reuters.com/technology/china-linked-hacking-group-accessing-calling-records-worldwide-crowdstrike-says-2021-10-19/

* https://www.darkreading.com/data-privacy/chinese-apt-backdoor-found-in-ccleaner-supply-chain-attack

* https://news.sky.com/story/obama-tells-china-president-hacking-must-stop-10345126

* https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach

* https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf

* https://en.wikipedia.org/wiki/PLA_Unit_61398

* https://en.wikipedia.org/wiki/Titan_Rain

* https://www.csis.org/programs/strategic-technologies-program/survey-chinese-espionage-united-states-2000

* https://www.nytimes.com/2024/12/16/us/politics/biden-administration-retaliation-china-hack.html

* https://github.com/shadow1ng/fscan/blob/main/README_EN.md

* https://github.com/sensepost/reGeorg

* https://www.cisa.gov/sites/default/files/2024-05/MAR-10448362.c1.v2.CLEAR_.pdf

* https://proxylogon.com/

* https://www.picussecurity.com/resource/blog/salt-typhoon-removing-chinese-telecom-equipment

* https://threatpost.com/famoussparrow-spy-hotels-governments/174948/

* https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf

* https://www.trendmicro.com/en_us/research/24/k/earth-estries.html

* https://cyberscoop.com/suspected-chinese-hackers-took-advantage-of-microsoft-exchange-vulnerability-to-steal-call-records/

* https://portswigger.net/daily-swig/a-whole-new-attack-surface-researcher-orange-tsai-documents-proxylogon-exploits-against-microsoft-exchange-server

* https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/

* https://cyberscoop.com/famoussparrow-eset-microsoft-exchange-proxylogon/

* https://www.c4isrnet.com/cyber/2024/04/10/secretive-us-cyber-force-deployed-22-times-to-aid-foreign-governments/

* https://www.meritalk.com/articles/report-salt-typhoon-using-backdoor-malware-tactics/

* https://www.wsj.com/politics/national-security/u-s-officials-race-to-understand-severity-of-chinas-salt-typhoon-hacks-6e7c3951

* https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/

* https://www.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-pakistani-government-delivers-shad.html

* https://www.trendmicro.com/en_us/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html

* https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation

* https://www.trendmicro.com/en_us/research/24/k/earth-estries.html

* https://www.bleepingcomputer.com/news/security/salt-typhoon-hackers-backdoor-telcos-with-new-ghostspider-malware/

* https://cyberscoop.com/chinese-hack-nsa-tool-check-point/

* https://teamwin.in/index.php/2025/02/15/redmike-hackers-exploited-1000-cisco-devices-to-gain-admin-access/

* https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally

* https://cyberscoop.com/treasury-sanctions-chinese-cybersecurity-company-salt-typhoon-hacks/

* https://www.techtarget.com/searchsecurity/news/366617509/Treasury-Department-breached-through-BeyondTrust-service

* https://www.bleepingcomputer.com/news/security/us-treasury-department-breached-through-remote-support-platform/

* https://cyberscoop.com/salt-typhoon-us-telecom-hack-earth-estries-trend-micro-report/

* https://www.reuters.com/technology/cybersecurity/us-treasury-dept-issues-sanctions-related-salt-typhoon-hack-2025-01-17/

* https://www.wired.com/story/us-names-one-of-the-hackers-allegedly-behind-massive-salt-typhoon-breaches/

* https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices

* https://risky.biz/BTN106/

* https://en.wikipedia.org/wiki/Salt_Typhoon

* https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf

* https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming

* https://nvd.nist.gov/vuln/detail/cve-2023-2868

* https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/

* https://malpedia.caad.fkie.fraunhofer.de/actor/ghostemperor

* https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/

* https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/

* https://blog.talosintelligence.com/salt-typhoon-analysis/

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to IntrusionsinDepth Podcast. Stay informed, stay safe, and see you in the next episode!