G1045 · ATT&CK 19.1 group
Salt Typhoon
[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)
Aliases: Salt Typhoon
Mapped techniques (14)
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Career Path Continuing Education
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameModule 13 — Red-team infrastructure and operations
Red Team & Offensive Security · explicit-nameModule 1 — Defensive mission, operating model, and SOC service
Blue Team & Defensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-name
Vulnerability Research & Exploit Development · explicit-idModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Career Path Continuing Education
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameModule 13 — Red-team infrastructure and operations
Red Team & Offensive Security · explicit-nameModule 1 — Defensive mission, operating model, and SOC service
Blue Team & Defensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-name