Salt Typhoon
Threat actorKnown techniques
- T1005Data from Local System
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1020.001Traffic Duplication
- T1021.001Remote Desktop Protocol
- T1021.004SSH
- T1027.010Command Obfuscation
- T1040Network Sniffing
- T1046Network Service Discovery
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
- T1059.004Unix Shell
- T1059.006Python
- T1059.008Network Device CLI
- T1059.013Container CLI/API
- T1070.003Clear Command History
- T1070.007Clear Network Connection History and Configurations
- T1070.009Clear Persistence
- T1071.001Web Protocols
- T1071.002File Transfer Protocols
- T1072Software Deployment Tools
- T1078Valid Accounts
- T1082System Information Discovery
- T1090Proxy
- T1090.003Multi-hop Proxy
- T1095Non-Application Layer Protocol
- T1098.004SSH Authorized Keys
- T1105Ingress Tool Transfer
- T1110.001Password Guessing
- T1110.002Password Cracking
- T1132.001Standard Encoding
- T1136Create Account
- T1136.001Local Account
- T1190Exploit Public-Facing Application
- T1199Trusted Relationship
- T1543.005Container Service
- T1548.003Sudo and Sudo Caching
- T1552.001Credentials In Files
- T1556Modify Authentication Process
- T1569System Services
- T1571Non-Standard Port
Malware and tools used
Source: MITRE ATT&CKSecurity timeline
- Activity reported by Cisco TalosTalos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
Recent news
Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
Talos IR found phishing was the top initial access method at just over one-third of engagements, down from over 50 percent, with vishing and help desk impersonation used to get victims to allow remote access via legitimate RMM tools. Exploitation of public-facing applications, mainly edge devices, accounted for one-third. Ransomware and pre-ransomware activity reached 27 percent, involving The Gentlemen, Qilin, Rhysida, Interlock and the newer VYPR, with EDR disabled via vulnerable drivers or WDAC.