Menu

Individual skill

salt-typhoon-earth-estries

Adversary-emulation profile for Salt Typhoon (G1045 / Earth Estries / GhostEmperor / FamousSparrow / UNC2286 / RedMike / OPERATOR PANDA), a PRC state-sponsored cyber-espionage actor targeting telecommunications and critical infrastructure worldwide.

packages/decepticon/decepticon/skills/shared/adversary-emulation/salt-typhoon/SKILL.md

Read pinned source

Source commit df879550544d36b6b1e69062f05adae28537adf2

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 8, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
6,567
Repository last updated
Nov 7, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Salt Typhoon (Earth Estries, GhostEmperor, FamousSparrow) — Adversary Emulation Profile

Salt Typhoon (MITRE ATT&CK **G1045**) is a People's Republic of China (PRC) state-backed cyber-espionage group that has been active since at least 2019, with operations traced back to 2021 targeting network infrastructure worldwide. The group is best known for its sustained, large-scale compromises of major U.S. and global telecommunications providers and ISPs, exploiting edge network devices — particularly Cisco IOS XE routers — for long-term covert access. Salt Typhoon is characterized by its focus on network-layer operations (router compromise, GRE/IPsec tunneling, traffic interception via SPAN/ERSPAN), heavy use of living-off-the-land techniques on network devices, a broad custom malware arsenal (DEMODEX kernel rootkit, GhostSpider modular backdoor, SnappyBee/Deed RAT, Crowdoor, ZINGDOOR, HemiGate, MASOL RAT), and exploitation of N-day vulnerabilities in edge appliances from Cisco, Ivanti, Fortinet, Sophos, and Palo Alto Networks. The group's operations ultimately enable Chinese intelligence services to identify and track targets' communications and movements globally.

## Attribution & motivation

- **Sponsor / nation:** People's Republic of China — linked to the Ministry of State Security (MSS) and multiple China-based entities including Sichuan Juxinhe Network Technology Co. Ltd., Beijing Huanyu Tianqiong Information Technology Co. Ltd., and Sichuan Zhixin Ruijie Network Technology Co. Ltd. These companies provide cyber-related products and services to the PLA and MSS. The U.S. Treasury sanctioned Sichuan Juxinhe for Salt Typhoon activity in January 2025.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** — interception of telecommunications metadata and content, tracking of intelligence targets' communications and movements. Secondary motivation includes **pre-positioning in critical infrastructure** for potential future disruptive operations, consistent with broader PRC cyber strategy.
- **Attribution confidence:** **High.** Backed by a joint 23-nation CISA/NSA/FBI advisory (AA25-239A, August 2025), U.S. Treasury OFAC sanctions, Cisco Talos technical analysis, and consistent named vendor reporting (Microsoft, Trend Micro, Kaspersky, ESET, Mandiant).

## Targeting

- **Sectors:** Telecommunications providers and ISPs (primary); government agencies; transportation; lodging/hospitality; military infrastructure; defense; technology and consulting firms; chemical industry; NGOs.
- **Regions:** Global — heavy focus on the **United States**, Southeast Asia (Philippines, Thailand, Malaysia, Indonesia, Vietnam, India, Taiwan), Africa (South Africa, Eswatini), Middle East (Afghanistan), South America (Brazil), and allied Five Eyes nations (Australia, Canada, New Zealand, United Kingdom). Operations confirmed across 13+ countries.