Your manager has just informed you that, due to recent budget cuts, you’ll need to take on additional responsibilities in threat analysis. As a junior threat intelligence analyst at a cybersecurity firm, you’re now tasked with investigating a cyber espionage campaign linked to a group known as Salt Typhoon. Apparently, defending against sophisticated Nation-State cyber threats is now a “do more with less” kind of game.
Your Task: Conduct comprehensive research on Salt Typhoon, focusing on their tactics, techniques, and procedures. Utilize the MITRE ATT&CK framework to map out their activities and provide actionable insights.
Your findings could play a pivotal role in fortifying our defenses against this adversary. Dive deep into the data and show that even with a shoestring budget, you can outsmart the cyber baddies.
Salt Typhoon is a state-backed espionage group that has been going after telecom networks for years, and it is tracked under several names depending on the vendor and the year. The MITRE profile leads to a custom Linux implant built to run on network gear, where it sniffs traffic and wipes logs. A Picus write-up ties the group to exploitation of an edge firewall flaw and to a Windows backdoor that persists through the registry. Trend’s report on the same actor under another name adds a TLS-protected multi-modular backdoor with Cloudflare-hosted C2. Going back to a 2021 Securelist report shows the same operators running a kernel-mode rootkit delivered by an encrypted PowerShell dropper, which hides its service from the service list through a dedicated IOCTL.
This case ships no evidence files. Everything comes from public reporting:
Naming note: Vendors use different names for the same group. Each question says which source to read, so answer with the name that source uses, not the one in the case title.
The Salt Typhoon group page (G1045) describes the actor as state-backed and names the country in its first paragraph. The attribution is stated there, not inferred from the technique list.
The same G1045 description gives an earliest activity year with “since at least” wording. Report the year only.
G1045 says the group targets the network infrastructure of telecommunications providers and ISPs. The answer is the infrastructure type, which is the one word that fits a seven-character mask.
Gotcha: The mask would also fit a word like “Telecom”. The page’s wording is about network infrastructure, so that is the one to submit.
Open the software entry S1206 directly, or follow it from the “Software” table at the bottom of G1045. The page title is the malware name.
The S1206 page describes the sample as an ELF x86-64 binary, which puts it on Linux. That fits network appliances running a Linux base.
The S1206 description states the implementation language in its opening sentence. Two characters, matching the mask.
The S1206 description says it works as a packet capture utility on a named vendor’s devices. It is the same page as Q4 to Q6, no pivot needed.
The S1206 techniques table lists “Clear Linux or Mac System Logs” under Indicator Removal. That is the sub-technique the question wants, and its ID is the legacy T1070.002. This one was reasoned rather than read straight off the page: the live site has since renumbered the Indicator Removal parent to T1685, but the answer mask (*****.***) only fits the old T1070.002 format, and that is what was accepted.
Gotcha: ATT&CK’s current numbering shows T1685 for the parent technique. The format hint is the clue that the legacy ID is expected.
The Picus Salt Typhoon blog lists the CVEs the group has used, each tagged with its product. Find the entry labelled Sophos Firewall.
Further down the same Picus blog, the Crowdoor section shows a reg add command. The key it writes to is the per-user autorun location.
Picus labels the registry change with its ATT&CK mapping right next to the example: Modify Registry. The Run key itself would map to Registry Run Keys (T1547.001), but the question asks for the technique the blog names.
The Trend blog uses its own cluster name throughout, not Salt Typhoon. The two-word mask matches the name in the title and body.
Search the Trend blog for the quoted phrase. It sits in the description of one of the backdoors the blog attributes to the actor, and the backdoor’s name is in capitals in the same paragraph.
The blog body doesn’t spell the domains out. Trend publishes a separate IOC list file (ioc-list-earthestries.txt) next to the article. Under the campaign that carries the backdoor from Q13 (Campaign Beta), one C2 domain is a workers.dev subdomain, the only .dev entry.
The text of the article never names the file. The answer is in Figure 10, an image of the backdoor’s first network request to the C2 server. Open the image and read the request line, which is a GET for a PHP file.
Tip: Text-only page extraction skips images. Open the figure itself when a question asks about a request or a packet.
The Securelist article from that date introduces the actor under the name in its title. This predates the Salt Typhoon label, which is why the question says “at that time”.
The article is centred on one kernel-mode implant, named in the introduction and used as a heading through the technical sections.
Kaspersky classes the implant by what it does to the kernel: it runs as a driver and hides artifacts from the operating system. The seven-character mask gives the category.
The infection-chain section of the Securelist article says the PowerShell is decrypted at run time with a key supplied by the attacker. The cipher is named in that sentence.
The rootkit section of the Securelist article lists the IOCTL codes the user-mode component sends to the driver. Find the one described as hiding the service from the list in services.exe memory and copy the hex value as written.
| Phase | Action |
|---|---|
| Initial Access | Exploitation of a Sophos Firewall vulnerability on an edge device |
| Persistence | Crowdoor backdoor persists through a reg add to the HKCU Run key |
| Command and Control | Multi-modular backdoor talks over a TLS-protected custom protocol to C2, including a workers.dev domain |
| Defense Evasion | Kernel-mode rootkit hides its service from the list in services.exe through an IOCTL |
| Execution | PowerShell dropper decrypted with an attacker-supplied AES key |
| Credential Access | Go-based Linux implant sniffs packets on Cisco devices |
| Defense Evasion | Same implant erases Linux system logs |
| Type | Value |
|---|---|
| CVE | CVE-2022-3236 (Sophos Firewall) |
| Registry key | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |
| Domain | telcom[.]grishamarkovgf8936[.]workers[.]dev |
| C2 request | GET /index.php |
| Malware | JumbledPath, GHOSTSPIDER, Demodex, Crowdoor |
| IOCTL | 0x220300 |
| Technique | ID | Description |
|---|---|---|
| Exploit Public-Facing Application | T1190 | Sophos Firewall CVE used against an edge device (mapping drawn from the Picus CVE list) |
| Boot or Logon Autostart Execution: Registry Run Keys | T1547.001 | Crowdoor persistence in the HKCU Run key |
| Modify Registry | T1112 | The technique Picus assigns to the Crowdoor reg add |
| Indicator Removal: Clear Linux or Mac System Logs | T1070.002 | Log erasure by the Go-based Linux implant |
| Network Sniffing | T1040 | The same implant captures packets on Cisco devices |
| Rootkit | T1014 | Kernel-mode driver hides its service and other artifacts |
| Command and Scripting Interpreter: PowerShell | T1059.001 | First-stage dropper in the 2021 chain |
| Obfuscated Files or Information | T1027 | PowerShell body hidden under AES encryption |
Edge devices need the same patch urgency as servers. The Picus list ties the group to exploitation of a firewall flaw, which means the first foothold sat on a device that rarely runs EDR. Track vendor advisories for every perimeter product and treat a KEV-listed CVE there as an emergency change.
Network device logs are an attacker target, so ship them off-box. The Linux implant sniffs traffic on Cisco gear and erases system logs. Forward device syslog to a collector in real time, because anything kept only on the appliance can be wiped by the same implant.
Alert on writes to autorun keys. The Crowdoor example is a single reg add against the HKCU Run key. Registry-modification telemetry on Run and RunOnce values catches it, and the persistence value should be allow-listed against known software.
Watch for C2 on shared developer-hosting platforms. One C2 domain is a workers.dev subdomain, which blends into normal traffic and can’t be blocked by TLD or reputation. Flag newly seen subdomains of such platforms from servers and network devices that have no reason to talk to them.
Kernel rootkits hide from the host, so look from outside. The 2021 rootkit removes its own service from the list in services.exe. Live host queries will miss it, and memory acquisition plus driver-load logging is where it shows up.
Salt Typhoon’s footprint spans edge exploits, Windows persistence, Linux network-device implants and a kernel rootkit under several vendor names since at least 2019. Tracking the actor means tying those names and tools back to one operator, and ATT&CK, vendor reports and IOC lists together do that without any evidence of one’s own.