Skip to content

Salt Typhoon

IntrusionSet · ATTACK:enterprise:G1045

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1045",
  "title": "Salt Typhoon",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1045",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--1c3dcf91-b859-4aae-a09c-ae26dc8b6390",
  "external_id": "G1045",
  "domain": "enterprise",
  "created": "2025-02-24T20:45:14.093Z",
  "modified": "2026-09-23T16:05:01.158Z",
  "version": "2.0",
  "aliases": [
    "Salt Typhoon"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CarySentinelLabs_CiscoSaltTyphoon_Dec2025",
      "url": "https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/"
    },
    {
      "source_name": "CISA_AA25-239ASaltTyphoon_Sept2025",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"
    },
    {
      "source_name": "Cisco Salt Typhoon FEB 2025",
      "url": "https://blog.talosintelligence.com/salt-typhoon-analysis/"
    },
    {
      "source_name": "CrowdStrike_OperatorPanda_NoDate",
      "url": "https://www.crowdstrike.com/en-us/adversaries/operator-panda/"
    },
    {
      "source_name": "RF_SaltTyphoon_Feb2025",
      "url": "https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices"
    },
    {
      "source_name": "Mandiant_M-Trends2026_Mar2026",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026"
    },
    {
      "source_name": "Microsoft_ThreatActorNaming_NoDate",
      "url": "https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming"
    },
    {
      "source_name": "US Dept. of Treasury Salt Typhoon JAN 2025",
      "url": "https://home.treasury.gov/news/press-releases/jy2792"
    }
  ]
}

Explicit source assertions (59)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1584.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01794c3e-407a-42c1-b6ba-16ec85775011

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1070.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04532a62-12c8-475b-ae10-8f4d035aeb53

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04d06aaa-505c-473e-ae33-7ef5e560a7a7

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1685.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095462d0-a8be-41cb-b930-a2f2a11fded2

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1686.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b5cb8e1-14e9-4064-9276-632f8ee96230

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e79e44d-036a-478f-a6f5-1acc420095bf

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0eee3018-adc1-49b4-ac6b-12aae2b0f67e

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1590.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--115aa415-fe5e-4e08-b629-f3da90c10fb2

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14f063a6-0819-4549-b9e0-44ee9e0f2fc8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25746c12-2e93-4b62-bc08-b0108b37252e

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25c3894b-69ee-49ba-8665-17e2dad68538

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1070.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--272caefb-af47-42a6-abaf-02754d15fdc1

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28d1f706-c879-4916-8591-dcf475029362

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b218139-1e96-4e15-9ac3-8d83b4aff072

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c0a250b-3669-4aab-9685-f9c04af6b4b4

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ccd3c21-47e3-4b44-ac5c-bff6af6cdf0f

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1569

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3927b0e9-9318-43ec-a27a-b8948c6ccffb

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3baa4f86-8ad4-4778-9327-1c23cebdfdca

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1548.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e8662c4-5177-49b3-9674-cb052d269731

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--490011ac-9105-4a35-bf4d-7fc3cd54a6a7

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1602.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4beefef9-978b-4834-8154-9aa892b41da8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50968078-c2bd-4822-895e-69983a37b235

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1098.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53113c1f-0cfd-453b-9044-d1da328f09c4

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1595

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a00d8fb-6d31-4d59-847b-7bf815af171c

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1020.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ac1eae9-0ae3-400d-9faf-758ad3a30027

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bf63d36-f3d2-4cc6-a2ad-b6bc2fffdba1

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1070.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c83c2c9-9042-4c6a-adac-788da36fc18d

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--706be608-c046-402e-ad71-c6042e0f88f2

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fec8e28-cc68-4245-b96c-1cf2b0b8c31a

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1602.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80da7758-2be4-4f34-bfa2-621120eb8a3f

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82548a34-d074-4c8f-af32-c7c5851377a8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83491142-3547-4944-b208-2a94d8536008

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1110.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--873d3695-4cd9-4e82-93d6-3960ae1efd4a

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1059.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8815c0f8-5b2c-47a7-9fb5-92268d8be174

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d0f3fa6-1e32-492e-8d34-f9f38a8e56ba

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--948e72c7-c744-4a3f-a592-7e0b3786951d

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1072

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a8dbb5c-c590-41ea-9404-0c78d6ae2d2a

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1543.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4170635-25df-4f04-8592-ef66cb929d83

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1587

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b23aa7d1-3752-423f-bf19-8595230406dc

CarySentinelLabs_CiscoSaltTyphoon_Dec2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b51cc81f-f723-4347-bb9e-b6042157e3e6

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7367fd5-bdd2-497e-a5f5-415fb833e56b

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb315101-e4b6-4ff2-a8bb-d063b9370dfa

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1affed6-5eee-4574-a921-a6102416bc5f

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c417a3d9-5a49-426d-be92-3763915fd370

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c43836c9-2b45-41a4-8f4f-838508043cfa

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1588.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7de5200-44f0-49bb-a48c-266d51e0125d

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c83116c0-b720-4efb-a074-f61e085ae30a

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9b1d1f1-d3eb-4df5-bda0-111a93ba326b

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d07edbd9-3fdd-43bd-9fa9-4fa7394a881c

CarySentinelLabs_CiscoSaltTyphoon_Dec2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1f53f90-7f79-488e-99ce-b2a8f688dad8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dad97f94-ac0e-43a1-bfd8-983132a0f1c0

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1599

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd695116-1767-40ac-bd13-cf4b5beca7a9

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1a5fbaf-0615-4662-947b-563be5a2a075

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3cf2c8a-2203-4ab4-9b37-1f0f27ea9240

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1059.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e448d474-1587-4e37-8024-967ab1ce6d30

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:S1206

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea6bde73-a671-42b8-a34c-8d97c3951d19

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1136

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee068884-27e4-4ec1-ae33-ba3ae58fcdd5

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3f0d678-c173-4817-8f61-803d7a8cc2e7

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f63e09a1-6ed2-48b4-9ba2-69eec39091b4

CarySentinelLabs_CiscoSaltTyphoon_Dec2025 · CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.