PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
MITRE ATT&CK G1032

Salt Typhoon

View MITRE Group Page ↗
Aliases: GhostEmperor, FamousSparrow
Official Attribution Source: CISA & FBI Joint Statement on Telecommunications Infiltration

Key Facts

Jurisdiction
People's Republic of China
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
  • Attributed Country: People's Republic of China.
  • ATT&CK Group Reference: G1032 (Salt Typhoon).
  • Linked to 1 primary court prosecution record(s) with $500.0 million documented loss.
  • Identified 0 individually charged operative(s) and 0 OFAC designation(s).

Primary ATT&CK Techniques Employed

ATT&CK Techniques Mapped to Salt Typhoon Technique frequencies extracted from verified indictments for Salt Typhoon. T1190 Exploit Public-Facing Application 1 incidents T1040 Network Sniffing 1 incidents
Technique frequencies extracted from verified indictments for Salt Typhoon.
ATT&CK Techniques Mapped to Salt Typhoon
Technique Frequency
T1190 Exploit Public-Facing Application 1 incidents
T1040 Network Sniffing 1 incidents

Prosecution Cases Attributed to Salt Typhoon

Salt Typhoon U.S. Telecommunications Wiretap Infrastructure Infiltration

investigation 2024-10-05

Chinese state-sponsored espionage campaign (Salt Typhoon / GhostEmperor / FamousSparrow) compromising core routing and lawful intercept infrastructure of major U.S. broadband and wireless carriers (including AT&T, Verizon, and Lumen), gaining persistent access to CALEA court-ordered wiretap requests and unencrypted call metadata of senior government officials.

Primary Attack Mechanism: Chinese state-sponsored threat actors exploited unpatched edge appliances and perimeter router interfaces to penetrate the core networks of major U.S. broadband and wireless carriers.
2 techniques mapped · Loss: $500.0 million View full case dossier →

Documented TTP Signature for Salt Typhoon

Test Controls in Stack Audit →
T1190: Exploit Public-Facing Application

Adversaries exploit vulnerabilities in internet-connected software such as web servers or VPN appliances.
T1040: Network Sniffing

Adversaries inspect network interface traffic using passive packet captures or wiretap tools to extract plaintext credentials and sensitive communications.