Salt Typhoon

Salt Typhoon, also known by aliases such as GhostEmperor and FamousSparrow, is a sophisticated Chinese state-sponsored cyber-espionage actor. The group has been highly active since at least 2020, specializing in gaining persistent access to critical infrastructure, specifically within the telecommunications and government sectors. Unlike commercial software products, Salt Typhoon operates as a 'hack-for-hire' ecosystem where state-affiliated contractors provide technical services to the Chinese government.

Recent investigations and data leaks have revealed that Salt Typhoon’s operations are deeply integrated within China’s national security apparatus. The group’s activities are directed toward intelligence collection and strategic 'prepositioning' within foreign networks. Their methods involve exploiting vulnerabilities in internet-facing systems to deploy custom rootkits and backdoors, allowing them to siphon sensitive communications and data for years without detection. The group effectively functions as a specialized extension of China’s Ministry of State Security (MSS).