G1045 · ATT&CK 20.0 group

Salt Typhoon

Aliases: Salt Typhoon

[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). [Salt Typhoon](https://attack.mitre.org/groups/G1045) has targeted and leveraged public facing network edge devices to gain access to victim environments. [Salt Typhoon](https://attack.mitre.org/groups/G1045) has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)(Citation: CarySentinelLabs_CiscoSaltTyphoon_Dec2025)(Citation: CrowdStrike_OperatorPanda_NoDate)(Citation: RF_SaltTyphoon_Feb2025)(Citation: Microsoft_ThreatActorNaming_NoDate)(Citation: Mandiant_M-Trends2026_Mar2026)

Aliases: Salt Typhoon

ATT&CK techniques

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

T1005 Data from Local System simulation — Exact active technique ID
T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1016 System Network Configuration Discovery simulation — Exact active technique ID
T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
T1018 Remote System Discovery simulation — Exact active technique ID
T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
T1020.001 Traffic Duplication simulation — Exact active technique ID
T1020.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1021.004 SSH simulation — Exact active technique ID
T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1027.010 Command Obfuscation simulation — Exact active technique ID
T1027.010 detection rules — Exact active technique ID; not actor-specific detector coverage
T1040 Network Sniffing simulation — Exact active technique ID
T1040 detection rules — Exact active technique ID; not actor-specific detector coverage
T1046 Network Service Discovery simulation — Exact active technique ID
T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol simulation — Exact active technique ID
T1048.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.004 Unix Shell simulation — Exact active technique ID
T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.006 Python simulation — Exact active technique ID
T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.008 Network Device CLI simulation — Exact active technique ID
T1059.008 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.013 Container CLI/API simulation — Exact active technique ID
T1059.013 detection rules — Exact active technique ID; not actor-specific detector coverage
T1070.003 Clear Command History simulation — Exact active technique ID
T1070.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1070.007 Clear Network Connection History and Configurations simulation — Exact active technique ID
T1070.007 detection rules — Exact active technique ID; not actor-specific detector coverage
T1070.009 Clear Persistence simulation — Exact active technique ID
T1070.009 detection rules — Exact active technique ID; not actor-specific detector coverage
T1071.001 Web Protocols simulation — Exact active technique ID
T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1071.002 File Transfer Protocols simulation — Exact active technique ID
T1071.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1072 Software Deployment Tools simulation — Exact active technique ID
T1072 detection rules — Exact active technique ID; not actor-specific detector coverage
T1078 Valid Accounts simulation — Exact active technique ID
T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
T1082 System Information Discovery simulation — Exact active technique ID
T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
T1090 Proxy simulation — Exact active technique ID
T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
T1090.003 Multi-hop Proxy simulation — Exact active technique ID
T1090.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1095 Non-Application Layer Protocol simulation — Exact active technique ID
T1095 detection rules — Exact active technique ID; not actor-specific detector coverage
T1098.004 SSH Authorized Keys simulation — Exact active technique ID
T1098.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1105 Ingress Tool Transfer simulation — Exact active technique ID
T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
T1110.001 Password Guessing simulation — Exact active technique ID
T1110.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1110.002 Password Cracking simulation — Exact active technique ID
T1110.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1132.001 Standard Encoding simulation — Exact active technique ID
T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1136 Create Account simulation — Exact active technique ID
T1136 detection rules — Exact active technique ID; not actor-specific detector coverage
T1136.001 Local Account simulation — Exact active technique ID
T1136.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1190 Exploit Public-Facing Application simulation — Exact active technique ID
T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
T1199 Trusted Relationship simulation — Exact active technique ID
T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
T1543.005 Container Service simulation — Exact active technique ID
T1543.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1548.003 Sudo and Sudo Caching simulation — Exact active technique ID
T1548.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1552.001 Credentials In Files simulation — Exact active technique ID
T1552.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1556 Modify Authentication Process simulation — Exact active technique ID
T1556 detection rules — Exact active technique ID; not actor-specific detector coverage
T1569 System Services simulation — Exact active technique ID
T1569 detection rules — Exact active technique ID; not actor-specific detector coverage
T1571 Non-Standard Port simulation — Exact active technique ID
T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
T1572 Protocol Tunneling simulation — Exact active technique ID
T1572 detection rules — Exact active technique ID; not actor-specific detector coverage
T1583.003 Virtual Private Server simulation — Exact active technique ID
T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1584.008 Network Devices simulation — Exact active technique ID
T1584.008 detection rules — Exact active technique ID; not actor-specific detector coverage
T1585.001 Social Media Accounts simulation — Exact active technique ID
T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1587 Develop Capabilities simulation — Exact active technique ID
T1587 detection rules — Exact active technique ID; not actor-specific detector coverage
T1587.001 Malware simulation — Exact active technique ID
T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1588.002 Tool simulation — Exact active technique ID
T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1588.005 Exploits simulation — Exact active technique ID
T1588.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1590.004 Network Topology simulation — Exact active technique ID
T1590.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1595 Active Scanning simulation — Exact active technique ID
T1595 detection rules — Exact active technique ID; not actor-specific detector coverage
T1599 Network Boundary Bridging simulation — Exact active technique ID
T1599 detection rules — Exact active technique ID; not actor-specific detector coverage
T1602.001 SNMP (MIB Dump) simulation — Exact active technique ID
T1602.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1602.002 Network Device Configuration Dump simulation — Exact active technique ID
T1602.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1610 Deploy Container simulation — Exact active technique ID
T1610 detection rules — Exact active technique ID; not actor-specific detector coverage
T1685 Disable or Modify Tools simulation — Exact active technique ID
T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
T1685.006 Clear Linux or Mac System Logs simulation — Exact active technique ID
T1685.006 detection rules — Exact active technique ID; not actor-specific detector coverage
T1686 Disable or Modify System Firewall simulation — Exact active technique ID
T1686 detection rules — Exact active technique ID; not actor-specific detector coverage
T1686.002 Network Device Firewall simulation — Exact active technique ID
T1686.002 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.