G1045: Salt Typhoon

Salt Typhoon has leveraged compromised routers to facilitate operations.[3]

Salt Typhoon has reverted or modified network configuration files to remove traces of activity.[3]

Salt Typhoon has discovered and modified network configurations of victim devices.[3]

Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.[2]

Salt Typhoon has modified the network firewalls access control lists to add IP addresses to bypass security policies and maintain access.[3]

Salt Typhoon has discovered system information details utilizing CLI on network devices.[3]

Salt Typhoon has collected credentials stored in configuration files.[3]

Salt Typhoon has used configuration files from exploited network devices to help discover upstream and downstream network segments.[2][3]

Salt Typhoon has scanned open ports and services within the victim environment.[3]

Salt Typhoon has enabled Linux containers in victim network device environments using `guestshell enable`.[3]

Salt Typhoon has modified the Authentication, Authorization, and Accounting (AAA) configurations forcing devices to use less secure authentication methods and to send information to their infrastructure.[3]

Salt Typhoon has removed persistence within victim devices through disabling and uninstalling artifacts.[3] Salt Typhoon has leveraged the commands `guestshell disable` and `guestshell destroy` to deactivate and uninstall Guest Shell containers and return all resources to the system to remove evidence of persistence.[3]

Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.[2]

Salt Typhoon has used Generic Routing Encapsulation (GRE) and IPsec tunnels to connect to C2 over non-application layer protocols.[3]

Salt Typhoon has opened and conducted operations utilizing RDP within victim environments.[3]

Salt Typhoon has leveraged multi-hop proxies for command-and-control infrastructure.[3]

Salt Typhoon has utilized SNMP daemon to execute commands to include SNMPwalk.[3]

Salt Typhoon has obfuscated target pathways with double encoding to bypass security solutions.[3]

Salt Typhoon has elevated privileges of local user accounts by editing `/etc/sudoers` or adding a file under `/etc/sudoers.d/`.[3]

Salt Typhoon has used custom tooling including JumbledPath.[2]

Salt Typhoon has enumerated device configuration using SNMP and gathered data stored in the Managed Information Base on target devices.[3]

Salt Typhoon has exfiltrated configuration files from exploited network devices over FTP and TFTP.[2][3]

Salt Typhoon has added SSH authorized_keys under root or other users at the Linux level on compromised network devices.[2][3]

Salt Typhoon has scanned victim environments for open ports and services.[3]

Salt Typhoon has enabled traffic mirroring to exfiltrate data.[3]

Salt Typhoon has used logged into accounts on Cisco devices by cracking weak hashed passwords from configuration files.[3]

Salt Typhoon has deleted and cleared logs to avoid detection.[3]

Salt Typhoon has used a variety of tools and techniques to capture packet data between network interfaces.[2][3]

Salt Typhoon has utilized virtual private servers (VPS) for C2 infrastructure.[3]

Salt Typhoon has attempted to acquire credentials by dumping network device configurations.[2][3] Salt Typhoon has also obtained data using RANCID.[3]

Salt Typhoon has leveraged non-standard ports to evade detection by security monitoring.[3]

Salt Typhoon has utilized virtual private servers and compromised routers as proxies for malicious communications.[3]

Salt Typhoon has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.[2]

Salt Typhoon has cracked weak hashed passwords stolen from configuration files.[3]

Salt Typhoon has executed commands on network devices using the native command line interface.[3]

Salt Typhoon has leveraged Tcl scripts on Cisco IOS devices to include `TCLprox.tcl` and `map.tcl` when `tclsh` was available.[3]

Salt Typhoon also leveraged TACACS+ and RADIUS to modify victim network devices.[3]

Salt Typhoon has created local user accounts to utilize in victim environments.[3]

Salt Typhoon has also created administrative accounts within compromised environments.[3]

Salt Typhoon has utilized a bash shell to execute Linux commands.[3]

Salt Typhoon has abused network management tools to include RANCID to facilitate actions in victims’ environments.[3]

Salt Typhoon has modified container service configurations using `Guest Shell`.[3]

Salt Typhoon has hosted and attended formal training programs for foreign-made IT products to include Cisco Network Academy.[4]

Salt Typhoon has utilized HTTP and HTTPS in C2 communications.[3]

Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).[2] Salt Typhoon has also enabled SSH to allow remote access.[3]

Salt Typhoon has leveraged SFTP for C2 communications.[3]

Salt Typhoon has used SNMPwalk to enumerate devices.[3]

Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.[2]

Salt Typhoon has gathered data from victim devices.[3]

Salt Typhoon has obtained and utilized numerous exploits that target network edge devices to include Cisco IOS, Palo Alto Pan-OS Global Protect, and Ivanti Connect Secure.[3]

Salt Typhoon has used weak credentials to gain access to victim devices.[3]

Salt Typhoon has downloaded additional payloads and files to victim devices.[3]

Salt Typhoon members have created and maintained professional accounts on social media to include LinkedIn.[4]

Salt Typhoon has used Python scripts to execute commands on victim hosts.[3]

Salt Typhoon has disabled logging and disabled the distribution of logs to log aggregators.[3]

Salt Typhoon has abused peer connections to exfiltrate data.[3]

Salt Typhoon has used publicly available tooling to exploit vulnerabilities.[2][3]

Salt Typhoon has also obtained and utilized open-source tools for creating backdoors and multi-hop proxies to include STOWAWAY.[3]

Salt Typhoon has utilized double encoding with hexadecimals in attempts to obfuscate requested command paths.[3]

Salt Typhoon has leveraged Cisco Guest Shell to interact with a Linux Container on network devices.[3]

Salt Typhoon has created Linux-level users on compromised network devices through modification of `/etc/shadow` and `/etc/passwd`.[2]

Salt Typhoon has leveraged compromised devices associated with trusted connections or those associated with private interconnections to include provider-to-provider or provider-to-customer relationships in order to pivot to target networks.[3]

Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.[2][3][4]