Security Resilience

Threat actor · all actors

Salt TyphoonG1045 state

🇨🇳 CN · MSS

aka Salt Typhoon, GhostEmperor, FamousSparrow, UNC2286, RedMike, OPERATOR PANDA

Last updated: 2026-10-16

8attributed CVEs
23ATT&CK techniques
22.3IDF score (tooling uniqueness)
0exclusive CVEs
2008–2026years active

About this actor

GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G1045

Microsoftweather-system names

Salt Typhoon

CrowdStrikenation-animal names

OPERATOR PANDA

MandiantUNC uncategorised cluster

UNC2286

Unclassifiedno scheme matched

GhostEmperorFamousSparrowRedMike

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 23 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2008: 1 CVE published120082018: 1 CVE published120182021: 1 KEV added120212023: 2 CVE published2023: 2 KEV added420232024: 3 CVE published2024: 3 KEV added620242026: 1 KEV added12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2023-20198 KEV10.010.00.99572023-10-16see CVE
CVE-2024-3400 KEV10.010.01.00002024-04-12see CVE
CVE-2018-0171 KEV9.99.80.99512018-03-28see CVE
CVE-2024-21887 KEV9.09.11.00002024-01-12see CVE
CVE-2023-46805 KEV8.98.20.99992024-01-12see CVE
CVE-2008-4128 KEV8.78.10.33922008-09-18see CVE
CVE-2023-20273 KEV8.17.20.92652023-10-25see CVE
CVE-2008-412813 0.00.00.0000see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-417 / 2374%
AC-316 / 2370%
CM-616 / 2370%
AC-613 / 2357%
CM-213 / 2357%
CM-713 / 2357%
AC-212 / 2352%
AC-511 / 2348%
CA-711 / 2348%
IA-211 / 2348%
AC-2010 / 2343%
SI-310 / 2343%
AC-48 / 2335%
CM-58 / 2335%
SC-78 / 2335%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category