Silk Typhoon
MITRE G1008
Reports
3
First seen
May 4, 2026
Last seen
Oct 16, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×3T1195 Supply Chain Compromise ×1T1021.002 Remote Services: SMB/Windows Admin Shares ×1T1486 Data Encrypted for Impact ×1T1566 Phishing ×1T1199 Trusted Relationship ×1T1070.001 Clear Windows Event Logs ×1T1078 Valid Accounts ×1T1598 Phishing for Information ×1T1505.003 Web Shell ×1T1021 Remote Services ×1T1110 Brute Force ×1
Indicators
cve ×19domain ×1filename ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2024-12686 (exploited)CVE-2024-12356 (exploited)CVE-2026-1731 (exploited)CVE-2025-0282 (exploited)CVE-2025-55182 (exploited)CVE-2025-59528 (exploited)CVE-2026-102764 (exploited)CVE-2026-32201 (exploited)CVE-2026-35616 (exploited)CVE-2026-40138CVE-2026-40139CVE-2026-40140CVE-2023-46805 (exploited)CVE-2026-40141CVE-2023-4966 (exploited)CVE-2024-21887 (exploited)