Salt Typhoon APT Analysis 2025: GhostSpider Malware, US Telecom Breach, and Threat Hunting Queries for SOC Teams

When Trend Micro published their analysis of Earth Estries in September 2023, most people in the threat intelligence community recognised it as a significant Chinese APT report — but the full scale of what that group had accomplished in US telecommunications infrastructure did not become public until late 2024. The Senate Intelligence Committee hearings in November and December of that year described what officials called the worst telecommunications hack in US history, with Chinese state-sponsored actors maintaining persistent access inside nine major telecom carriers for potentially years. This is an analysis of what that campaign looked like technically, how the malware families work, and what detection queries SOC teams should be running right now.

Actor Attribution and Tracking Names

Salt Typhoon is Microsoft’s tracking designation for this actor. You will see the same group documented under different names depending on the vendor reporting: Earth Estries (Trend Micro), FamousSparrow (ESET), GhostEmperor (Kaspersky), and UNC2286 (Mandiant/Google). The overlapping TTPs and shared malware code across these reports confirm they describe the same or closely related Chinese state-sponsored intrusion sets.

The group has been active since at least 2019, with systematic targeting of telecommunications, government, technology, and consulting sectors across multiple continents. The 2024 US telecom campaign represents the highest-impact confirmed operation attributed to this actor.

The CALEA Breach: What It Actually Means

The most significant element of the Salt Typhoon campaign is not the volume of data stolen but the specific systems accessed. Several of the compromised carriers had their CALEA (Communications Assistance for Law Enforcement Act) infrastructure breached.

CALEA, enacted in 1994, legally requires US telecommunications carriers to build wiretap capabilities into their infrastructure so that law enforcement can intercept communications with a valid court order. These lawful intercept systems are the mechanism through which the FBI, DEA, and other agencies conduct court-authorised surveillance.

Salt Typhoon gained read access to these systems. The practical implication: Chinese intelligence had visibility into US government surveillance operations, including the identities of individuals under investigation, the content of intercepted communications, and the existence of ongoing counterintelligence operations. Senior US officials including the Director of National Intelligence described specific instances of communications between government officials being accessed.

This is not primarily a cybersecurity story. It is a counterintelligence catastrophe — one that required the FBI to brief Senate leadership in a classified session and prompted CISA to issue emergency guidance on telecommunications network security.

Confirmed Victim Organisations

The following organisations have been publicly confirmed as Salt Typhoon victims, either through government statements, SEC filings, or corporate disclosures:

• AT&T — CALEA access confirmed; Senate briefings referenced specific AT&T infrastructure
• Verizon — Breach confirmed; magnitude of access not fully disclosed
• T-Mobile — Multiple intrusion attempts; company stated detection and prevention in most cases but acknowledged some access
• Lumen Technologies — Backbone infrastructure provider; significant due to traffic transit role
• Windstream — Confirmed in US government briefings
• Consolidated Communications — Regional carrier; confirmed victim
• Charter Communications — Confirmed in Senate intelligence committee references

Nine carriers were cited in Senate briefings as of December 2024. Not all have made public disclosures as of mid-2026.

Malware Family Breakdown

GhostSpider

GhostSpider is the primary modular backdoor used in the Salt Typhoon campaign and the most extensively documented malware from this actor cluster. It was identified in 2023 by Trend Micro researchers and is attributed with high confidence to Earth Estries based on code overlaps with prior Earth Estries tools.

Technical architecture: GhostSpider is a modular backdoor that loads capabilities from encrypted plugin files on disk. The core loader establishes encrypted communication with C2 infrastructure and downloads plugins as needed. This architecture makes static analysis and detection by file hash nearly useless — the core loader looks the same regardless of which capabilities are currently loaded.

Encryption: C2 communications use ChaCha20 stream cipher with an ECDH (Elliptic-Curve Diffie-Hellman) key exchange, generating a unique session key per connection. This prevents traffic decryption without the private key even if traffic is captured.

Supported plugin commands (documented by Trend Micro):

• ProxyConnect — establish proxy tunnel through the backdoor host
• FileOperation — read, write, delete, copy, enumerate files
• RegOperation — read, write, delete, enumerate registry keys
• ProcessOperation — list, create, terminate processes
• ShellExecute — execute shell commands
• LoadPlugin — load additional capability modules from C2

Persistence: GhostSpider achieves persistence via Windows Services and scheduled tasks, using service names and task descriptions that blend with legitimate system services.

DEMODEX (Rootkit)

DEMODEX is a kernel-mode rootkit attributed to the same actor cluster, first documented by GhostEmperor in 2021. It operates at ring-0 privilege level, meaning it runs with full OS access and can hide processes, network connections, files, and registry entries from user-mode tools including EDR agents.

The rootkit uses a signed kernel driver exploit to load unsigned code into the kernel. On older Windows versions, it exploits legitimate signed drivers with known vulnerabilities to bypass Driver Signature Enforcement (DSE). On more recent Windows 11 systems with Secure Boot and HVCI (Hypervisor-Protected Code Integrity) properly configured, kernel rootkit loading is significantly harder — making Secure Boot and HVCI critical mitigations.

DEMODEX specifically targets Chelsio network adapter drivers in some variants for its kernel code loading mechanism. Hunt for abnormal behaviour associated with Chelsio drivers on systems that do not have Chelsio NICs installed.

MASEPIE (Loader)

MASEPIE, also called SnappyBee in some reporting, is a loader that handles initial payload delivery and decryption. It communicates with C2 using HTTP with custom headers and provides the initial dropper mechanism that ultimately deploys GhostSpider. MASEPIE uses process hollowing to inject into legitimate Windows processes, making it difficult to distinguish from normal process activity.

SALTWATER (Cisco Backdoor)

SALTWATER is a backdoor that specifically targets Cisco IOS XE devices — network infrastructure rather than Windows endpoints. It disguises itself as a Cisco IOS module and installs a persistent backdoor on compromised routers. SALTWATER supports file upload/download, command execution, and proxying, all from within the compromised network device itself. This means it operates entirely outside of any Windows EDR visibility.

Cisco IOS XE Exploitation Chain

The initial access vector for the telecom intrusions was exploitation of two Cisco IOS XE vulnerabilities, both disclosed in October 2023 and both observed as zero-days before patches existed:

The exploitation chain works as follows: CVE-2023-20198 is exploited first to create a rogue admin account on the IOS XE device. That newly-created account is then used to exploit CVE-2023-20273, which executes commands with root privilege. The root-level access is used to implant the SALTWATER or similar IOS-level backdoor. The web shell planted during exploitation provides persistent access even after a reboot, until the device firmware is fully replaced.

At peak exploitation, researchers at Censys and VulnCheck documented over 50,000 Cisco IOS XE devices compromised with web shells within 48 hours of the initial CVE disclosures — one of the fastest exploitation waves documented for a network infrastructure vulnerability.

MITRE ATT&CK Mapping

Threat Hunting Queries

Microsoft Sentinel (KQL): Cisco IOS XE Web Shell Access

If your Cisco devices are configured to forward syslog to Sentinel (via the CEF or Syslog connector), the following queries surface exploitation indicators:

// Cisco IOS XE - CVE-2023-20198 web shell access pattern
CommonSecurityLog
| where TimeGenerated > ago(90d)
| where DeviceVendor == "Cisco"
| where Message has_any (
    "logoutconfirm.html",
    "logon_hash=",
    "webui/logoutconfirm",
    "/webui/?retUrl="
)
| project TimeGenerated, DeviceAddress, SourceIP,
          DeviceProduct, Message
| order by TimeGenerated desc

// Cisco IOS XE - Rogue account creation (CVE-2023-20198 post-exploitation)
CommonSecurityLog
| where TimeGenerated > ago(90d)
| where DeviceVendor == "Cisco"
| where Activity has_any ("user added", "privilege level", "username")
| where Message has "15"   // Privilege level 15 = full admin
| project TimeGenerated, DeviceAddress, SourceIP, Message, Activity
| order by TimeGenerated desc

// Unusual IOS XE management access (non-management-IP source)
let MgmtIPs = dynamic(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor == "Cisco"
| where Activity has_any ("login", "ssh", "telnet", "http", "https")
| where not(ipv4_is_in_any_range(SourceIP, MgmtIPs))
| project TimeGenerated, DeviceAddress, SourceIP, Activity, Message
| order by TimeGenerated desc

Sentinel (KQL): GhostSpider C2 Behavioral Detection

// Detect process hollowing indicators (GhostSpider injection technique)
// Look for processes whose parent-child relationship is unusual
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (
    "svchost.exe", "dllhost.exe", "taskhost.exe",
    "taskeng.exe", "werfault.exe", "spoolsv.exe"
)
| where FileName in~ (
    "cmd.exe", "powershell.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe"
)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, FileName,
          ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Detect MASEPIE/GhostSpider C2 beacon pattern
// Look for periodic HTTPS connections from unusual processes to consistent IPs
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort == 443
| where InitiatingProcessFileName in~ (
    "svchost.exe", "dllhost.exe", "taskhost.exe", "regsvr32.exe"
)
| summarize
    ConnectionCount = count(),
    UniqueRemoteIPs = dcount(RemoteIP),
    IPList = make_set(RemoteIP),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where ConnectionCount between (5 .. 30)
    and UniqueRemoteIPs == 1   // Beaconing to a consistent single IP
| order by ConnectionCount desc

Splunk SPL: IOS XE Exploitation and GhostSpider Detection

// Cisco IOS XE web shell exploitation (syslog source)
index=network_devices sourcetype=cisco:ios
("logoutconfirm" OR "logon_hash" OR "/webui/") src_ip!="10.*" src_ip!="172.16.*" src_ip!="192.168.*"
| eval alert="Possible IOS XE CVE-2023-20198 exploitation"
| table _time, src_ip, dest_ip, uri, alert
| sort -_time

// Privilege-15 account creation on Cisco device (rogue admin)
index=network_devices sourcetype=cisco:ios
"privilege" "15" ("added" OR "created" OR "config")
| rex field=_raw "username (?<created_user>S+)"
| table _time, host, created_user, _raw
| eval alert="CRITICAL: Privilege-15 account creation on network device"

// GhostSpider process hollowing pattern (Windows host)
index=sysmon EventCode=8
TargetImage IN ("*\svchost.exe","*\dllhost.exe","*\taskhost.exe")
NOT SourceImage IN ("*\services.exe","*\wininit.exe","*\svchost.exe")
| table _time, host, SourceImage, TargetImage, StartAddress
| eval alert="Suspicious remote thread injection into system process"

YARA Rule: GhostSpider Detection

rule SaltTyphoon_GhostSpider_Loader
{
    meta:
        description   = "Detects GhostSpider modular backdoor loader used by Salt Typhoon in US telecom intrusions"
        author        = "vivekverma.in"
        date          = "2025-07-28"
        reference     = "https://www.trendmicro.com/en_us/research/23/l/earth-estries-targets-government-tech-for-cyberespionage.html"
        hash_note     = "Modular architecture - loader hash varies by campaign"
        tlp           = "WHITE"
    strings:
        $cfg_chacha   = "chacha20" nocase wide ascii
        $cfg_ecdh     = "ecdh" nocase wide ascii
        $cmd_proxy    = "ProxyConnect" wide ascii
        $cmd_file     = "FileOperation" wide ascii
        $cmd_reg      = "RegOperation" wide ascii
        $cmd_proc     = "ProcessOperation" wide ascii
        $cmd_plugin   = "LoadPlugin" wide ascii
        $mutex        = "Global\Ghost" wide ascii
    condition:
        uint16(0) == 0x5A4D
        and filesize < 5MB
        and (
            ($mutex)
            or (2 of ($cfg_*) and 2 of ($cmd_*))
            or (all of ($cmd_*))
        )
}

Indicators of Compromise

The following indicators are drawn from public reporting by Trend Micro, Cisco Talos, and government advisories. IOCs for this actor rotate frequently — treat these as pattern indicators rather than long-lived blocklist entries:

File system artifacts to check:

• Unusual files in C:WindowsSystem32 or C:WindowsSysWOW64 with generic names matching system DLL patterns but with recent creation timestamps
• Scheduled tasks with descriptions containing strings like "Microsoft Edge Update" or "Windows Telemetry" but running from non-standard paths
• Services installed from %TEMP% or user profile directories

Network indicators to check:

• IOS XE web shell responding to requests at /webui/logoutconfirm.html?logon_hash=[hex_string]
• Unexpected SSH sessions originating from Cisco routers to internal Windows hosts
• HTTPS connections from network management servers to external IPs during off-hours

Active Directory indicators:

• New accounts created with generic names (numeric suffixes, service-style names) with Privilege Level 15 on network devices
• Authentication from network device IP ranges to Windows domain controllers via NTLM

What Your SOC Should Prioritise

The Salt Typhoon campaign reveals a threat model that most enterprise security programmes are not built to handle: a nation-state actor with years of patience, operating from within network infrastructure rather than on Windows endpoints, targeting the systems that feed your SIEM rather than the SIEM itself.

Three immediate actions based on this analysis:

1. Audit your Cisco IOS XE devices right now. Run show ip http server secure status and check for unexpected accounts with privilege level 15. If you are running any IOS XE version prior to the October 2023 security patch, assume you are compromised and treat the device accordingly. A firmware re-image is the minimum remediation — configuration restore alone does not remove a planted web shell.

2. Extend your logging to network infrastructure. If your SOC is not ingesting syslog from routers, switches, and firewall devices, you are blind to an entire attack surface that Salt Typhoon exploited for years without triggering a single Windows-based EDR alert. CEF syslog from Cisco IOS, Fortinet FortiOS, and Palo Alto PAN-OS into your SIEM is non-negotiable for this threat class. The Palo Alto GlobalProtect zero-day analysis on this blog covers a closely related network device exploitation vector.

3. Implement HVCI and Secure Boot. DEMODEX rootkit requires loading unsigned kernel code. HVCI (Hypervisor-Protected Code Integrity), which is enabled by default on Windows 11 compatible hardware, prevents this class of attack. Systems still running Windows 10 without HVCI are significantly more vulnerable to kernel-level rootkit implantation.

The Salt Typhoon campaign was ultimately possible not because the techniques were sophisticated beyond detection — the Cisco CVEs were patchable, the malware families were detectable. It succeeded because of the time between initial access and detection, the focus on infrastructure that security teams do not typically monitor, and the patient, deliberate operational tempo that is characteristic of Chinese state-sponsored actors operating under strategic rather than financial objectives.

Sources: Trend Micro: Earth Estries APT Analysis | CISA Advisory on Salt Typhoon Telecom Intrusions | T-Mobile SEC Disclosure | MITRE ATT&CK Earth Estries Profile | Cisco Talos IOS XE Zero-Day Analysis