Salt Typhoon

MITRE G1013

Reports

First seen

Jul 23

Last seen

Jun 10

Motivation

espionage, espionage, lawful intercept access

Targeting

Sectors

telecommunications ×1other ×1government ×1

Victim regions

United Kingdom ×1United States ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×7T1566 Phishing ×5T1078 Valid Accounts ×3T1486 Data Encrypted for Impact ×3T1047 Windows Management Instrumentation ×2T1598 Phishing for Information ×2T1195 Supply Chain Compromise ×2T1021 Remote Services ×2T1110 Brute Force ×2T1041 Exfiltration Over C2 Channel ×2T1003 OS Credential Dumping ×2T1005 Data from Local System ×2

Indicators

cve ×29domain ×9filename ×8url ×3email ×1ip_v4 ×1

Indicator values are available on Pro and via the API.

Recent reports

High

CERT-EU Cyber Brief January 2026 – Espionage, Ransomware, and Critical Vulnerabilities

CERT-EU Threat IntelFeb 2 High

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat IntelNov 1 High

Risky Business #799 — Multiple critical vulnerabilities and breaches across tech vendors

Risky BusinessJul 23

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

UK weakens telecoms defenses against Chinese hackers after industry pushback

State-Sponsored Actors: Operational Tradecraft and Incident Response Strategy

U.S. Public Sector Under Siege: Q1 2026 Threat Intelligence Report

2025 Cloud Threat Hunting and Defense Landscape

Risky Business #824 — Microsoft's Secure Future is looking a bit wobbly

CERT-EU Cyber Brief January 2026 – Espionage, Ransomware, and Critical Vulnerabilities

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

Risky Business #799 — Multiple critical vulnerabilities and breaches across tech vendors