This report provides an analysis of Salt Typhoon, a threat actor known for its cyber-espionage operations targeting critical infrastructure and government entities. The report focuses on indicators observed in recent campaigns, including malware samples, exploited vulnerabilities, and activity patterns. It also highlights lookup queries useful for identifying related activity across environments. The findings are based on data from open intelligence sources and cybersecurity research. It is not an in-depth analysis of Salt Typhoon’s tactics and techniques but a collection of technical artifacts to help track, detect, and understand the actor’s operations, with an emphasis on their recent activity across Southeast Asia, North America, and parts of Africa.
Salt Typhoon is a Chinese state-sponsored cyber espionage group active since 2019. Its operations primarily focus on Southeast Asia, North America, and parts of Africa. The group specializes in long-term, covert access to the networks of telecommunications providers, government entities, and critical infrastructure, including internet service providers and energy organizations. Salt Typhoon’s primary objective is the theft of sensitive information, such as government communications and data related to law enforcement activity. The actor demonstrates a high level of technical capability, operational discipline, and resource backing consistent with intelligence-driven operations.
Espionage
Financial gain
Unveiling Long Term Earth Estries Cyber Intrusions
2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c586195872669ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85cUnveiling Long Term Earth Estries Cyber Intrusions
The activity is linked to a SnapyBee sample, which is characterized by the use of C2 domains such as api.solveblemten[.]com and esh.hoovernamosong[.]com. In one instance, related files were observed, including imfsbSvc.exe, imfsbDll.dll, DgApi.dll, and dbindex.dat.
With the following TI lookup query, we can search through recent public tasks and identify this malicious activity.
TI lookup:
domainName:"esh.hoovernamosong.com" and filePath:"imfsb*"
Sample:ANY.RUN
SHA-256: fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5
SHA-256: fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098
SHA-256: b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac
SHA-256: 05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870
SHA-256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
SHA-256: 1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296
SHA-256: 5b88f7d36fe435cd6944bda05f1758f64c7d5136a5f529a58522ac3b0dc9743a
SHA-256: 6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc
Unveiling Long Term Earth Estries Cyber Intrusions
SHA-256: f1a968a0c0021fda6a8fb76b6a00af78c056e3fcc6110d429118fc1e059aa420
Sample:ANY.RUN
Earth Estries: A Long-Running Cyberespionage Campaign
44ea2e85ea6cffba66f5928768c1ee401f3a6d6cd2a04e0d681d695f93cc5a1fAnalysis of Persistent TTPs in a Long-Term Cyberespionage Campaign
CrowDoor Sample Published on X
cd8630f8e07e16203195f563457a84beb08112fcbb4d9ee1056a788174cf8f6b98ddf03ca6ade4770cc06ac8034b3468bd94094f5813d28b74885e5ca6958895Analysis of Persistent TTPs in a Long-Term Cyberespionage Campaign
Earth Estries Targets Government and Tech in Cyberespionage Campaign
42d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb909abc579097b0bd8d115702bb1eeb546d2401373c83385a52386ad4243f945e8292f70bff5717608c289f4146febcc06a2c5d8192529a8c51e18ec0f7b44d1cfefb98b8f882ac84332e7dfdc996a081d1c5e6189ad726f8f8afec5d36a20a7308476ad68ce54b458217ab165d66a899d764eae3ad30196f35d2ff20d3f398523dff1d282e754f378ef00fb6ebe9944fee6607d9ee24ec3ca643da27f27520ac3Unveiling Long Term Earth Estries Cyber Intrusions
Earth Estries Targets Government, Tech, and Diplomacy in New Cyberespionage Campaign
Unveiling Long Term Earth Estries Cyber Intrusions
103.91.64.214165.154.227.19223.81.41.166158.247.222.165172.93.165.1491.245.253.27103.75.190.7345.125.67.14443.226.126.164172.93.165.10193.239.86.164146.70.79.18146.70.79.105205.189.160.396.9.211.2743.226.126.165139.59.108.43185.105.1.243139.178.92.175139.99.114.108139.59.236.31104.194.153.65203.20.113.208materialplies.comnews.colourtinctem.comapi.solveblemt.comesh.hoovernamosong.comvpn114240349.softether.netimap.dateupdate.compulseathermakf.comwww.infraredsen.combilling.clothworks.comhelpdesk.stnekpro.comjasmine.lhousewares.comprivate.royalnas.comtelcom.grishamarkovgf8936.workers.devvpn305783366.softether.netvpn487875652.softether.netvpn943823465.softether.netfc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b8230982fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c586195872669ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bcb2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa8701a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296Breaking Down Earth Estries’ Persistent TTPs in Prolonged Cyber Operations
42d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb995062728536f23b1335756ae1a1d68f1df22d58594ece9998cae6b73772fd49f6a4de5c7787e212dea5f033f8f7cd39aefc93e7c83c8564dc2204813e8e76ff227042218e8d1a0491525b35a6dc2fc0737841bcaed65b751e78769eadeda9751c32156a7de42a61f5d584e82dfbced690d23fd72080024c14a9143e5f20f0ad8a298031b1c28f11f00d3b9f6311fbfae881d6c789e70c4bc5e6ccdf8165b94c6cdde7878ed0529f9ef3ad58aa3084f1df6e2fb371807b15539187539b060fed26f274955b1fb58cc9a60476bc5a9cd9d54c962cc29e73db41b7786148cb7450509abc579097b0bd8d115702bb1eeb546d2401373c83385a52386ad4243f945e8292f70bff5717608c289f4146febcc06a2c5d8192529a8c51e18ec0f7b44d1cfcd8630f8e07e16203195f563457a84beb08112fcbb4d9ee1056a788174cf8f6b98ddf03ca6ade4770cc06ac8034b3468bd94094f5813d28b74885e5ca695889503365cce37db511fdfaf8d77a14f806a2d822a111aa8cc032b5b341c0b0064a51378bde3aee0057ca2a5854fee4d184479491ec624a3bbf215098afaa6b82299b17660d1a4c0258739024187497be0b11530791d1307d9e5556f04f0ac58d42fb450311b5fc4333b26955f7c709ca61fcfdba168f1a8839a93979a892a8c22cc39f1c7095e1db05944eeda08a2e1c1b8c513ea581bfc0cb36ad106e3a8f38b5f0c8c0b2837fbb9c15da1bfb904ed3f3903e2d4d49c999394068f274b014a09dda113c637bb81f9bbd39731672b242a8da5915ef4b5e93d72cc9a7454b5e120bd4aeaa0d954268d4fc7179ec7578258c3459ee95b82698363e0cafb700c05181ad0575b3ced944dc627d047c60f23d25bd3aa0c4deab69f784b9a80aae50fbd7b25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc103.159.133.20945.192.178.20838.54.71.140103.159.133.205103.103.131.40103.15.28.228154.220.3.17156.255.2.202103.103.128.121162.19.135.182cdglobalclouds.combroadmediacloud.comzmail.broadmediacloud.comwww.nodtecloud.commail2-0da8aa1c.oxcdntech.comhelpdesk.athenatechlabs.comsupports.flarecastdns.comns.starkaero.compay.johannesburghotel.netkidshomeworkabc.global.ssl.fastly.netap.missmichiko.comportal.sppokemon.comsvn.truecdnnetwork.comlync.realtxholdem.comglobalnetzone.b-cdn.netamazoncdns.comwww.euphemismscase.sitewww.dbacloudsupport.comwww.cloudshappen.comwww.amazoncdns.comsupports.dbacloudsupport.comssl3.awsdns-531.comsoffice.offices-analytics.comservices.offices-analytics.comresource.offices-analytics.comredsquare.redcrossco.comportal.techmersion.comportal.cdglobalclouds.comopengl.cloudshappen.comns108.cloudshappen.comns101.awsdns-531.comms119.newsfreecloud.comms101.cloudshappen.commail.euphemismscase.sitellnw-dd.awsdns-531.comimages.dbacloudsupport.comhelpdesk.cloudshappen.comhelpdesk.athenatechlabs.comglobal.techmersion.comge.huseinhbz.clickftp.techmersion.comeuphemismscase.siteemv1.techmersion.comemv1.cdglobalclouds.comde.huseinhbz.clickcredits.offices-analytics.comcloudsrv.cloudfrontsrv.comcdn181.awsdns-531.comcdn101.cloudflaresrv.comcdglobalclouds.comcas04.awsdns-531.comcachecloud.cloudflaresrv.comcache10.newsfreecloud.comc11r.awsdns-531.comblog.techmersion.comauth.boxlibraries.comEarth Estries Targets Government and Tech in Cyberespionage Campaign
cd2b703e1b7cfd6c552406f44ec05480209003789ad4fbba4d4cffd4f104b0a00eaa67fe81cec0a41cd42866df1223cb7d2b5659ab295dffe64fe9c3b76720aae6f9756613345fd01bbcf28eba15d52705ef4d144c275b8cfe868a5d28c24140c7023183e815b9aff68d3eba6c2ca105dbe0a9b05cd209908dcee907a64ce80b1a9e0c7c88e7a8b065ec88809187f67d920e7845350d94098645e592ec5534f6efb98b8f882ac84332e7dfdc996a081d1c5e6189ad726f8f8afec5d36a20a7308476ad68ce54b458217ab165d66a899d764eae3ad30196f35d2ff20d3f398523dff1d282e754f378ef00fb6ebe9944fee6607d9ee24ec3ca643da27f27520ac342d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb945b9204ccbad92e4e5fb9e31aab683eb5221eb5f5688b1aae98d9c0f1c92022798e250bc06de38050fdeab9b1e2ef7e4d8c401b33fd5478f3b85197112858f4eb1bc10fa25a4fd5ae7948c6523eb975be8d0f52d1572c57a7ef736134b99658649a0349dfa79b211fc2c5753a9b87f8cd2e9a42e55eca6f350f30c60de2866ce71a503b5b6ec8321346bee3f6129af0b8ad490a36092488d085085cdc0fc6b9d28109c650df5481c3997b720bf8ce09e7472d9cdb3f02dd844783fd2b1400c72a8dd0ca6151000de33335f48a832d24412de13ce05ea6f279bf4aaaa2e5aaecbdeaa3143814c6fe9279e8bc0706df22d63ef197af980d8feae9a8468f441efecb6481e0edc36a0472ab0ce7d0817f1773c4af9307ae60890a667930558a762ffeeb3d2e87d343b2acf6bc8e4e4122d76a9ad200ae52340c61e537a80666705ed4b014891df3348a76750563ae10b70721e028381f3964930d2dd49b9597ffac32531891691ef674345f098ef18b274091acdf3f2808cca753674599c043ccd7dc59e17806e3a58792f07662b4985119252c8221688084d20b599699bfdb272d8e1a7e5f27362aaf0d12b58b96a816ef61a2a498def9805297aa81f6f83729230ca6713bedbd19c2ad560700b41774825615b0fe80bf61751177ffbc26c77aa30cdadad8d7ced1370baa5d1ffe435bed78c2d58ed4cda364b8a7484e3c7cdac9882f3384723b21f9a928029bb3ee116f9adbc4f7ec66d5a856e817c3dc16d149d415e0893ce227464fb29d76e0500c518935d11379d17fb14effaef82e962ff76f6223d956df81dcb6135c6ce00ee14d0efede9fb399b56d2ee95b7b0538fe12ccloudlibraries.global.ssl.fastly.netshinas.global.ssl.fastly.netzmailssl3.global.ssl.fastly.netnx2.microware-help.comeast.smartpisang.comcdn728a66b0.smartlinkcorp.netcdn-6dd0035.oxcdntech.comcdn-7a3d.vultr-dns.comweb9a78bc52.trhammer.comaccess.trhammer.comms101.cloudshappen.comhttps[:]//103.159.133.205/index.asp?id=432103.159.133.20596.44.160.181Earth Estries Expands Cyberespionage Operations in Asia and Beyond
fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b8230982fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c586195872669ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bcb2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa8701a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296103.91.64.214165.154.227.19223.81.41.166158.247.222.165172.93.165.1491.245.253.27103.75.190.7345.125.67.14443.226.126.164172.93.165.10193.239.86.168146.70.79.18146.70.79.105205.189.160.396.9.211.2743.226.126.165139.59.108.43185.105.1.243143.198.92.175139.99.114.108139.59.236.31104.194.153.65materialplies.comnews.colourtinctem.comapi.solveblemten.comesh.hoovernamosong.comvpn114240349.softether.netimap.dateupdata.compulseathermakf.comwww.infraredsen.combilling.clothworls.comhelpdesk.stnekpro.comjasmine.lhousewares.comprivate.royalnas.comtelcom.grishamarkovgf8936.workers.devvpn305783366.softether.netvpn487875652.softether.netvpn943823465.softether.netSalt Typhoon Targets Telecoms in Strategic Cyber Threat Campaign
23DEA3A74E3FF6A367754D02466DB4C86FFDA47EFE09529D3AAD52B0D5694B302B5E7B17FC6E684FF026DF3241AF4A651FC2B55CA62F8F1F7E34AC8303DB9A318DF9FA495892FC3D183917162746EF8FD9E438FF0D639264236DB553B09629DCB63C82FC37F0E9C586D07B96D70FF802D4B707FFB2D59146CF7D7BB922C52E7ESalt Typhoon exploits vulnerable Cisco devices
CVE-2023-20198CVE-2023-20273Cisco confirms Salt Typhoon exploited critical vulnerabilities
CVE-2018-0171Talos analyzes Salt Typhoon's attacks on telecommunications
CVE-2024-20399Earth Estries: A Long-Running Cyberespionage Campaign
CVE-2023-46805CVE-2024-21887CVE-2023-48788CVE-2022-3236