Salt Typhoon Attacks

Overview

This report provides an analysis of Salt Typhoon, a threat actor known for its cyber-espionage operations targeting critical infrastructure and government entities. The report focuses on indicators observed in recent campaigns, including malware samples, exploited vulnerabilities, and activity patterns. It also highlights lookup queries useful for identifying related activity across environments. The findings are based on data from open intelligence sources and cybersecurity research. It is not an in-depth analysis of Salt Typhoon’s tactics and techniques but a collection of technical artifacts to help track, detect, and understand the actor’s operations, with an emphasis on their recent activity across Southeast Asia, North America, and parts of Africa.

About Salt Typhoon

Salt Typhoon is a Chinese state-sponsored cyber espionage group active since 2019. Its operations primarily focus on Southeast Asia, North America, and parts of Africa. The group specializes in long-term, covert access to the networks of telecommunications providers, government entities, and critical infrastructure, including internet service providers and energy organizations. Salt Typhoon’s primary objective is the theft of sensitive information, such as government communications and data related to law enforcement activity. The actor demonstrates a high level of technical capability, operational discipline, and resource backing consistent with intelligence-driven operations.

Origin Country

  • China

Motivation

  • Espionage

  • Financial gain

First Seen

  • 2019

Targeted Countries

  • USA
  • Argentina
  • Bangladesh
  • Indonesia
  • Malaysia
  • Mexico
  • Netherlands
  • Thailand
  • Vietnam
  • Myanmar
  • United Kingdom
  • India
  • Taiwan
  • Philippines
  • Afghanistan
  • Brazil
  • Eswatini
  • Pakistan

Industry Attacked

  • Telecom
  • Education
  • Government

DEMODEX

Unveiling Long Term Earth Estries Cyber Intrusions

  • SHA-256: 2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec
  • SHA-256: 16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266
  • SHA-256: 9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c

SNAPPYBEE (Deed RAT)

Unveiling Long Term Earth Estries Cyber Intrusions

The activity is linked to a SnapyBee sample, which is characterized by the use of C2 domains such as api.solveblemten[.]com and esh.hoovernamosong[.]com. In one instance, related files were observed, including imfsbSvc.exe, imfsbDll.dll, DgApi.dll, and dbindex.dat.

With the following TI lookup query, we can search through recent public tasks and identify this malicious activity.

TI lookup: domainName:"esh.hoovernamosong.com" and filePath:"imfsb*"

  • Sample:ANY.RUN

  • SHA-256: fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5

  • SHA-256: fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098

  • SHA-256: b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac

  • SHA-256: 05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870

  • SHA-256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b

  • SHA-256: 1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296

  • SHA-256: 5b88f7d36fe435cd6944bda05f1758f64c7d5136a5f529a58522ac3b0dc9743a

  • SHA-256: 6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc

TRAMSCAT

Unveiling Long Term Earth Estries Cyber Intrusions

  • SHA-256: f1a968a0c0021fda6a8fb76b6a00af78c056e3fcc6110d429118fc1e059aa420

  • Sample:ANY.RUN

MASOL

Earth Estries: A Long-Running Cyberespionage Campaign

  • SHA-256: 44ea2e85ea6cffba66f5928768c1ee401f3a6d6cd2a04e0d681d695f93cc5a1f

Crowdoor

Analysis of Persistent TTPs in a Long-Term Cyberespionage Campaign

CrowDoor Sample Published on X

  • SHA-256: cd8630f8e07e16203195f563457a84beb08112fcbb4d9ee1056a788174cf8f6b
  • SHA-256: 98ddf03ca6ade4770cc06ac8034b3468bd94094f5813d28b74885e5ca6958895

ZINGDOOR

Analysis of Persistent TTPs in a Long-Term Cyberespionage Campaign

Earth Estries Targets Government and Tech in Cyberespionage Campaign

  • SHA-256: 42d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb9
  • SHA-256: 09abc579097b0bd8d115702bb1eeb546d2401373c83385a52386ad4243f945e8
  • SHA-256: 292f70bff5717608c289f4146febcc06a2c5d8192529a8c51e18ec0f7b44d1cf
  • SHA-256: efb98b8f882ac84332e7dfdc996a081d1c5e6189ad726f8f8afec5d36a20a730
  • SHA-256: 8476ad68ce54b458217ab165d66a899d764eae3ad30196f35d2ff20d3f398523
  • SHA-256: dff1d282e754f378ef00fb6ebe9944fee6607d9ee24ec3ca643da27f27520ac3

GHOSTSPIDER

Unveiling Long Term Earth Estries Cyber Intrusions

SparrowDoor

Earth Estries Targets Government, Tech, and Diplomacy in New Cyberespionage Campaign

IOC Summary

Unveiling Long Term Earth Estries Cyber Intrusions

IOCs (Click to expand)
  • ip: 103.91.64.214
  • ip: 165.154.227.192
  • ip: 23.81.41.166
  • ip: 158.247.222.165
  • ip: 172.93.165.14
  • ip: 91.245.253.27
  • ip: 103.75.190.73
  • ip: 45.125.67.144
  • ip: 43.226.126.164
  • ip: 172.93.165.10
  • ip: 193.239.86.164
  • ip: 146.70.79.18
  • ip: 146.70.79.105
  • ip: 205.189.160.3
  • ip: 96.9.211.27
  • ip: 43.226.126.165
  • ip: 139.59.108.43
  • ip: 185.105.1.243
  • ip: 139.178.92.175
  • ip: 139.99.114.108
  • ip: 139.59.236.31
  • ip: 104.194.153.65
  • ip: 203.20.113.208
  • domain: materialplies.com
  • domain: news.colourtinctem.com
  • domain: api.solveblemt.com
  • domain: esh.hoovernamosong.com
  • domain: vpn114240349.softether.net
  • domain: imap.dateupdate.com
  • domain: pulseathermakf.com
  • domain: www.infraredsen.com
  • domain: billing.clothworks.com
  • domain: helpdesk.stnekpro.com
  • domain: jasmine.lhousewares.com
  • domain: private.royalnas.com
  • domain: telcom.grishamarkovgf8936.workers.dev
  • domain: vpn305783366.softether.net
  • domain: vpn487875652.softether.net
  • domain: vpn943823465.softether.net
  • SHA-256: fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5
  • SHA-256: fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098
  • SHA-256: 2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec
  • SHA-256: 16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266
  • SHA-256: 9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c
  • SHA-256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
  • SHA-256: 6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc
  • SHA-256: b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac
  • SHA-256: 05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870
  • SHA-256: 1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296

Breaking Down Earth Estries’ Persistent TTPs in Prolonged Cyber Operations

IOCs (Click to expand)
  • SHA-256: 42d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb9
  • SHA-256: 95062728536f23b1335756ae1a1d68f1df22d58594ece9998cae6b73772fd49f
  • SHA-256: 6a4de5c7787e212dea5f033f8f7cd39aefc93e7c83c8564dc2204813e8e76ff2
  • SHA-256: 27042218e8d1a0491525b35a6dc2fc0737841bcaed65b751e78769eadeda9751
  • SHA-256: c32156a7de42a61f5d584e82dfbced690d23fd72080024c14a9143e5f20f0ad8
  • SHA-256: a298031b1c28f11f00d3b9f6311fbfae881d6c789e70c4bc5e6ccdf8165b94c6
  • SHA-256: cdde7878ed0529f9ef3ad58aa3084f1df6e2fb371807b15539187539b060fed2
  • SHA-256: 6f274955b1fb58cc9a60476bc5a9cd9d54c962cc29e73db41b7786148cb74505
  • SHA-256: 09abc579097b0bd8d115702bb1eeb546d2401373c83385a52386ad4243f945e8
  • SHA-256: 292f70bff5717608c289f4146febcc06a2c5d8192529a8c51e18ec0f7b44d1cf
  • SHA-256: cd8630f8e07e16203195f563457a84beb08112fcbb4d9ee1056a788174cf8f6b
  • SHA-256: 98ddf03ca6ade4770cc06ac8034b3468bd94094f5813d28b74885e5ca6958895
  • SHA-256: 03365cce37db511fdfaf8d77a14f806a2d822a111aa8cc032b5b341c0b0064a5
  • SHA-256: 1378bde3aee0057ca2a5854fee4d184479491ec624a3bbf215098afaa6b82299
  • SHA-256: b17660d1a4c0258739024187497be0b11530791d1307d9e5556f04f0ac58d42f
  • SHA-256: b450311b5fc4333b26955f7c709ca61fcfdba168f1a8839a93979a892a8c22cc
  • SHA-256: 39f1c7095e1db05944eeda08a2e1c1b8c513ea581bfc0cb36ad106e3a8f38b5f
  • SHA-256: 0c8c0b2837fbb9c15da1bfb904ed3f3903e2d4d49c999394068f274b014a09dd
  • SHA-256: a113c637bb81f9bbd39731672b242a8da5915ef4b5e93d72cc9a7454b5e120bd
  • SHA-256: 4aeaa0d954268d4fc7179ec7578258c3459ee95b82698363e0cafb700c05181a
  • SHA-256: d0575b3ced944dc627d047c60f23d25bd3aa0c4deab69f784b9a80aae50fbd7b
  • SHA-256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
  • SHA-256: 6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc
  • ip: 103.159.133.209
  • ip: 45.192.178.208
  • ip: 38.54.71.140
  • ip: 103.159.133.205
  • ip: 103.103.131.40
  • ip: 103.15.28.228
  • ip: 154.220.3.17
  • ip: 156.255.2.202
  • ip: 103.103.128.121
  • ip: 162.19.135.182
  • domain: cdglobalclouds.com
  • domain: broadmediacloud.com
  • domain: zmail.broadmediacloud.com
  • domain: www.nodtecloud.com
  • domain: mail2-0da8aa1c.oxcdntech.com
  • domain: helpdesk.athenatechlabs.com
  • domain: supports.flarecastdns.com
  • domain: ns.starkaero.com
  • domain: pay.johannesburghotel.net
  • domain: kidshomeworkabc.global.ssl.fastly.net
  • domain: ap.missmichiko.com
  • domain: portal.sppokemon.com
  • domain: svn.truecdnnetwork.com
  • domain: lync.realtxholdem.com
  • domain: globalnetzone.b-cdn.net
  • domain: amazoncdns.com
  • domain: www.euphemismscase.site
  • domain: www.dbacloudsupport.com
  • domain: www.cloudshappen.com
  • domain: www.amazoncdns.com
  • domain: supports.dbacloudsupport.com
  • domain: ssl3.awsdns-531.com
  • domain: soffice.offices-analytics.com
  • domain: services.offices-analytics.com
  • domain: resource.offices-analytics.com
  • domain: redsquare.redcrossco.com
  • domain: portal.techmersion.com
  • domain: portal.cdglobalclouds.com
  • domain: opengl.cloudshappen.com
  • domain: ns108.cloudshappen.com
  • domain: ns101.awsdns-531.com
  • domain: ms119.newsfreecloud.com
  • domain: ms101.cloudshappen.com
  • domain: mail.euphemismscase.site
  • domain: llnw-dd.awsdns-531.com
  • domain: images.dbacloudsupport.com
  • domain: helpdesk.cloudshappen.com
  • domain: helpdesk.athenatechlabs.com
  • domain: global.techmersion.com
  • domain: ge.huseinhbz.click
  • domain: ftp.techmersion.com
  • domain: euphemismscase.site
  • domain: emv1.techmersion.com
  • domain: emv1.cdglobalclouds.com
  • domain: de.huseinhbz.click
  • domain: credits.offices-analytics.com
  • domain: cloudsrv.cloudfrontsrv.com
  • domain: cdn181.awsdns-531.com
  • domain: cdn101.cloudflaresrv.com
  • domain: cdglobalclouds.com
  • domain: cas04.awsdns-531.com
  • domain: cachecloud.cloudflaresrv.com
  • domain: cache10.newsfreecloud.com
  • domain: c11r.awsdns-531.com
  • domain: blog.techmersion.com
  • domain: auth.boxlibraries.com

Earth Estries Targets Government and Tech in Cyberespionage Campaign

IOCs (Click to expand)
  • SHA-256: cd2b703e1b7cfd6c552406f44ec05480209003789ad4fbba4d4cffd4f104b0a0
  • SHA-256: 0eaa67fe81cec0a41cd42866df1223cb7d2b5659ab295dffe64fe9c3b76720aa
  • SHA-256: e6f9756613345fd01bbcf28eba15d52705ef4d144c275b8cfe868a5d28c24140
  • SHA-256: c7023183e815b9aff68d3eba6c2ca105dbe0a9b05cd209908dcee907a64ce80b
  • SHA-256: 1a9e0c7c88e7a8b065ec88809187f67d920e7845350d94098645e592ec5534f6
  • SHA-256: efb98b8f882ac84332e7dfdc996a081d1c5e6189ad726f8f8afec5d36a20a730
  • SHA-256: 8476ad68ce54b458217ab165d66a899d764eae3ad30196f35d2ff20d3f398523
  • SHA-256: dff1d282e754f378ef00fb6ebe9944fee6607d9ee24ec3ca643da27f27520ac3
  • SHA-256: 42d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb9
  • SHA-256: 45b9204ccbad92e4e5fb9e31aab683eb5221eb5f5688b1aae98d9c0f1c920227
  • SHA-256: 98e250bc06de38050fdeab9b1e2ef7e4d8c401b33fd5478f3b85197112858f4e
  • SHA-256: b1bc10fa25a4fd5ae7948c6523eb975be8d0f52d1572c57a7ef736134b996586
  • SHA-256: 49a0349dfa79b211fc2c5753a9b87f8cd2e9a42e55eca6f350f30c60de2866ce
  • SHA-256: 71a503b5b6ec8321346bee3f6129af0b8ad490a36092488d085085cdc0fc6b9d
  • SHA-256: 28109c650df5481c3997b720bf8ce09e7472d9cdb3f02dd844783fd2b1400c72
  • SHA-256: a8dd0ca6151000de33335f48a832d24412de13ce05ea6f279bf4aaaa2e5aaecb
  • SHA-256: deaa3143814c6fe9279e8bc0706df22d63ef197af980d8feae9a8468f441efec
  • SHA-256: b6481e0edc36a0472ab0ce7d0817f1773c4af9307ae60890a667930558a762ff
  • SHA-256: eeb3d2e87d343b2acf6bc8e4e4122d76a9ad200ae52340c61e537a80666705ed
  • SHA-256: 4b014891df3348a76750563ae10b70721e028381f3964930d2dd49b9597ffac3
  • SHA-256: 2531891691ef674345f098ef18b274091acdf3f2808cca753674599c043ccd7d
  • SHA-256: c59e17806e3a58792f07662b4985119252c8221688084d20b599699bfdb272d8
  • SHA-256: e1a7e5f27362aaf0d12b58b96a816ef61a2a498def9805297aa81f6f83729230
  • SHA-256: ca6713bedbd19c2ad560700b41774825615b0fe80bf61751177ffbc26c77aa30
  • SHA-256: cdadad8d7ced1370baa5d1ffe435bed78c2d58ed4cda364b8a7484e3c7cdac98
  • SHA-256: 82f3384723b21f9a928029bb3ee116f9adbc4f7ec66d5a856e817c3dc16d149d
  • SHA-256: 415e0893ce227464fb29d76e0500c518935d11379d17fb14effaef82e962ff76
  • SHA-256: f6223d956df81dcb6135c6ce00ee14d0efede9fb399b56d2ee95b7b0538fe12c
  • domain: cloudlibraries.global.ssl.fastly.net
  • domain: shinas.global.ssl.fastly.net
  • domain: zmailssl3.global.ssl.fastly.net
  • domain: nx2.microware-help.com
  • domain: east.smartpisang.com
  • domain: cdn728a66b0.smartlinkcorp.net
  • domain: cdn-6dd0035.oxcdntech.com
  • domain: cdn-7a3d.vultr-dns.com
  • domain: web9a78bc52.trhammer.com
  • domain: access.trhammer.com
  • domain: ms101.cloudshappen.com
  • URL: https[:]//103.159.133.205/index.asp?id=432
  • ip: 103.159.133.205
  • ip: 96.44.160.181

Earth Estries Expands Cyberespionage Operations in Asia and Beyond

IOCs (Click to expand)
  • SHA-256: fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5
  • SHA-256: fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098
  • SHA-256: 2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec
  • SHA-256: 16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266
  • SHA-256: 9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c
  • SHA-256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
  • SHA-256: 6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc
  • SHA-256: b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac
  • SHA-256: 05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870
  • SHA-256: 1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296
  • ip: 103.91.64.214
  • ip: 165.154.227.192
  • ip: 23.81.41.166
  • ip: 158.247.222.165
  • ip: 172.93.165.14
  • ip: 91.245.253.27
  • ip: 103.75.190.73
  • ip: 45.125.67.144
  • ip: 43.226.126.164
  • ip: 172.93.165.10
  • ip: 193.239.86.168
  • ip: 146.70.79.18
  • ip: 146.70.79.105
  • ip: 205.189.160.3
  • ip: 96.9.211.27
  • ip: 43.226.126.165
  • ip: 139.59.108.43
  • ip: 185.105.1.243
  • ip: 143.198.92.175
  • ip: 139.99.114.108
  • ip: 139.59.236.31
  • ip: 104.194.153.65
  • domain: materialplies.com
  • domain: news.colourtinctem.com
  • domain: api.solveblemten.com
  • domain: esh.hoovernamosong.com
  • domain: vpn114240349.softether.net
  • domain: imap.dateupdata.com
  • domain: pulseathermakf.com
  • domain: www.infraredsen.com
  • domain: billing.clothworls.com
  • domain: helpdesk.stnekpro.com
  • domain: jasmine.lhousewares.com
  • domain: private.royalnas.com
  • domain: telcom.grishamarkovgf8936.workers.dev
  • domain: vpn305783366.softether.net
  • domain: vpn487875652.softether.net
  • domain: vpn943823465.softether.net

Salt Typhoon Targets Telecoms in Strategic Cyber Threat Campaign

IOCs (Click to expand)
  • SHA-256: 23DEA3A74E3FF6A367754D02466DB4C86FFDA47EFE09529D3AAD52B0D5694B30
  • SHA-256: 2B5E7B17FC6E684FF026DF3241AF4A651FC2B55CA62F8F1F7E34AC8303DB9A31
  • SHA-256: 8DF9FA495892FC3D183917162746EF8FD9E438FF0D639264236DB553B09629DC
  • SHA-256: B63C82FC37F0E9C586D07B96D70FF802D4B707FFB2D59146CF7D7BB922C52E7E

CVEs Used

Salt Typhoon exploits vulnerable Cisco devices

  • CVE-2023-20198
  • CVE-2023-20273

Cisco confirms Salt Typhoon exploited critical vulnerabilities

  • CVE-2018-0171

Talos analyzes Salt Typhoon's attacks on telecommunications

  • CVE-2024-20399

Earth Estries: A Long-Running Cyberespionage Campaign

  • CVE-2023-46805
  • CVE-2024-21887
  • CVE-2023-48788
  • CVE-2022-3236

References

  • https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf
  • https://www.trendmicro.com/en_us/research/24/k/earth-estries.html
  • https://www.trendmicro.com/en_us/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html
  • https://x.com/0x680x610x6A/status/1761993166780330420
  • https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html
  • https://blog.talosintelligence.com/salt-typhoon-analysis/
  • https://thehackernews.com/2025/02/cisco-confirms-salt-typhoon-exploited.html
  • https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices
  • https://www.picussecurity.com/resource/blog/salt-typhoon-telecommunications-threat