Assessment at a glance
Identity: a People's Republic of China (PRC) state-sponsored espionage operation against network infrastructure, named Salt Typhoon by Microsoft and OPERATOR PANDA by CrowdStrike. The authoring governments of the August 2025 joint advisory do not adopt either name and refer to "APT actors". APT number: none assigned by any retained source. Priority exposure: telecommunications providers and the organisations reachable through them; internet-facing network devices, above all Cisco IOS XE devices with the web UI exposed and devices whose management services are reachable from untrusted networks.
Current assessment, 31 October 2026: the activity is continuing. Cisco Talos's incident-response report for Q3 2026 describes prolonged espionage intrusions in the telecommunications sector, most of them attributed with high confidence to China state-sponsored actors including Salt Typhoon, with valid credentials and CVE-2023-20198 as the entry methods and a BadCandy web-shell campaign for remote access. No government advisory published since has superseded AA25-239A (27 August 2025, revised 3 September 2025), which remains the most complete public description of the tradecraft. Confidence: high that the techniques below are reported first-hand by the cited investigators; moderate that every alias listed by every publisher denotes one operator, because ESET tracks FamousSparrow separately for lack of technical indicators linking it to Salt Typhoon.
Evidence currency: research checked on 31 October 2026 against the Blackjack corpus and the primary hosts cited here. Within the 90-day window, the actor-specific primary evidence is one section of Talos's 29 October quarterly report. The House Select Committee's 4 August 2026 report is a congressional investigation of three Chinese carriers' residual US footprint and routing behaviour; it is discussed below as infrastructure adjacency, not as evidence about the actor's tradecraft. Microsoft's naming table (page updated 21 October 2026) and ESET's 17 September report bear on aliases rather than on telecom intrusions. Everything else dates from 2023 to 2025 and is labelled as such. No 2026 joint government advisory and no 2026 vendor investigation specific to this actor's telecom activity was found on the hosts searched.
What changed in 2026
- Incident response still sees the activity (Q3 2026). Talos reports continuing, prolonged espionage intrusions in telecommunications, names the entry vulnerability (CVE-2023-20198 in publicly accessible web-based management interfaces) alongside valid credentials, names the implant seen in one campaign (BadCandy), and lists the on-device behaviour: privileged accounts created, logging disabled, configurations altered for persistence, and living-off-the-land use of VPN access, traffic mirroring and management protocols. These are observations from Talos's own engagements in the quarter, not a restatement of the 2025 advisory. Talos Q3 2026 report
- The alias set is sourced publisher by publisher, and the publishers differ in clustering threshold. Microsoft's naming table (page last updated 21 October 2026; the date the mapping was added is not shown) lists FamousSparrow as another name for Salt Typhoon; ESET's 17 September 2026 report states that it tracks FamousSparrow separately because no technical indicator links them. ESET does not deny the link; it declines to merge without evidence. Microsoft naming reference, ESET SparroWocky investigation
- A congressional investigation of the carriers, not an advisory about the actor. The House Select Committee on the CCP's 4 August 2026 report examines China Telecom, China Mobile and China Unicom's US operations and routing around the 2024 intrusions, and states that its routing findings do not definitively attribute the campaign to any company. It is treated below as infrastructure adjacency. Committee report page
- No new government advisory. AA25-239A (v1.1, 3 September 2025) remains the reference document; its statement that initial access vectors are a critical information gap has not been updated by a later joint product found in this research. AA25-239A
- Start dates depend on the publisher's cluster. The joint advisory dates the APT actors' global operations to at least 2021; CrowdStrike states that OPERATOR PANDA has conducted operations against the telecom and professional-services sectors since at least November 2024. Each date applies to its publisher's own cluster definition. That the CrowdStrike date post-dates Talos's three-year access case is, in TIR's inference, a difference of cluster scope rather than a contradiction; no retained primary source supports a start earlier than 2021.
Naming and attribution, by publisher
| Name | Asserted by | What the publisher states | Date basis |
|---|---|---|---|
| Salt Typhoon | Microsoft | Origin China; other names OPERATOR PANDA, GhostEmperor, FamousSparrow. Naming reference | Page updated 21 October 2026 |
| OPERATOR PANDA | CrowdStrike | China-nexus targeted intrusion adversary operating against telecom and professional-services sectors since at least November 2024; relies heavily on exploiting internet-facing appliances such as Cisco switches; its Cisco edge-device activity at US entities "aligns with Salt Typhoon". Community identifiers listed: Salt Typhoon, GhostEmperor, RedMike, UNC5807. Adversary profile | Undated profile page |
| Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, GhostEmperor | CISA, NSA, FBI and partner agencies | Industry reporting under these names "partially overlaps" with the agencies' cluster; they adopt no commercial name and warn the mapping "may not be a 1:1 correlation". AA25-239A | 27 August 2025, revised 3 September 2025 |
| Salt Typhoon | Canadian Centre for Cyber Security and FBI | Actors targeting Canadian telecoms are "almost certainly PRC state-sponsored actors, specifically Salt Typhoon"; the February 2025 device compromise is attributed to "likely Salt Typhoon actors". Cyber threat bulletin | Page dated 19 June 2025 |
| Salt Typhoon | Cisco Talos | February 2025: the US telecom campaign "dubbed Salt Typhoon", later confirmed by the US government. Q3 2026: most telecom espionage intrusions attributed with high confidence to China state-sponsored actors "including Salt Typhoon". February 2025 investigation, Q3 2026 report | 20 February 2025; 29 October 2026 |
| FamousSparrow | ESET | Tracked as a separate group: FamousSparrow "has also been publicly linked to Salt Typhoon" but ESET keeps them apart for want of any technical indicator. ESET also relays Trend Micro's link to Earth Estries, whose exact nature it calls not fully known. SparroWocky investigation | 17 September 2026 |
The joint advisory also links the operations to three China-based companies, Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology and Sichuan Zhixin Ruijie Network Technology, which it says provide cyber-related products and services to PRC intelligence services. These are linked entities, not aliases. AA25-239A
TIR assessment: use Salt Typhoon or OPERATOR PANDA for the telecom edge-device activity described below. Treat GhostEmperor, RedMike, UNC5807 and FamousSparrow as research pointers whose equivalence is asserted by some publishers and not established by others; no retained publisher states that the groups are distinct. ESET's September 2026 report, which concerns a Windows backdoor deployed against government organisations in Latin America, is cited here only for the alias boundary; it is not evidence about telecommunications networks or network devices, and its targeting should not be imported into this profile.
Operations timeline
| When | What is reported | Source and its date |
|---|---|---|
| Since at least 2021 | Global operations by the APT actors, including modifying routers for persistent access and pivoting between networks | Joint advisory, August 2025 |
| 2024 | Partner investigations find PRC state-sponsored actors inside major global telecoms, including US wireless carriers; customer call-record data stolen; private communications of a limited number of individuals, mainly in government or political activity, collected | Cyber Centre bulletin, June 2025, relaying partner reporting |
| Late 2024 | Public reporting of intrusions at several major US telecoms, later confirmed by the US government | Talos, February 2025 |
| Since at least November 2024 | CrowdStrike states that OPERATOR PANDA has conducted operations against the telecom and professional-services sectors | CrowdStrike profile, undated |
| Mid-February 2025 | Three network devices registered to a Canadian telecom compromised through CVE-2023-20198; running configurations retrieved; at least one modified to create a GRE tunnel | Cyber Centre bulletin, June 2025 |
| 20 February 2025 | Talos publishes its investigation: valid stolen credentials in all investigated cases but one; one case with evidence that CVE-2018-0171 was likely abused; access maintained in one instance for over three years | Talos, February 2025 |
| 27 August 2025 (revised 3 September) | AA25-239A published by CISA, NSA, FBI and partners, with TTPs, CVEs, detection guidance and the three named companies | Joint advisory |
| 4 August 2026 | House Select Committee on the CCP publishes "Stranger Pings", a bipartisan investigation of three Chinese carriers' US footprint launched in response to the Salt Typhoon intrusions; two routing case studies cover 22 to 25 September 2024 | Committee report page and full report |
| 17 September 2026 | ESET reports FamousSparrow's SparroWocky campaign in Latin America and states it tracks FamousSparrow separately from Salt Typhoon | ESET |
| 21 October 2026 | Microsoft's naming table, as last updated on this date, lists OPERATOR PANDA, GhostEmperor and FamousSparrow as other names for Salt Typhoon | Microsoft |
| 29 October 2026 (Q3 2026 engagements) | Talos IR continues to see prolonged telecom espionage intrusions; valid credentials and CVE-2023-20198 are the routine entry methods; one campaign deploys BadCandy | Talos, 29 October 2026 |
The last row dates Talos's report and its Q3 engagements, not the intrusions' start. Talos does not state its quarter boundaries or when the access in those cases began. Dates of reporting, of underlying activity and of discovery are kept separate throughout this profile.
Targeting: sectors, geography and devices
The joint advisory describes targeting of telecommunications, government, transportation, lodging and military infrastructure networks, with a focus on large backbone routers of major telecommunications providers and on provider-edge and customer-edge routers. It states that the cluster has been observed in the United States, Australia, Canada, New Zealand, the United Kingdom and other areas globally, and that the actors may target edge devices regardless of who owns them, because a device outside the core target set can still provide a path into one. Compromised devices and trusted interconnections, provider-to-provider or provider-to-customer, are used to pivot into other networks. AA25-239A
The Cyber Centre's separate investigations found overlaps with indicators associated with Salt Typhoon beyond the telecommunications sector, and it assesses that in some cases the activity was very likely limited to network reconnaissance. It assesses that PRC actors will almost certainly continue to target Canadian organisations, including telecommunications providers and their clients, over the two years from June 2025. Cyber threat bulletin
Talos's February 2025 investigation concerned several major US telecommunications companies and documented pivoting from a device at one telecom to a device at another, with the first device used as a hop point rather than the final target, and some hop points used as the first hop for outbound exfiltration. The pivoting crossed network equipment from several manufacturers. Talos investigation
Infrastructure adjacency: the August 2026 House committee report
On 4 August 2026 the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party published "Stranger Pings", a bipartisan investigation of China Telecom, China Mobile and China Unicom's residual US operations. The committee says it launched the investigation in connection with its March 2025 hearing and in response to the Salt Typhoon intrusions into US telecommunications infrastructure; when the three companies did not cooperate voluntarily, it subpoenaed them. Its page states that the companies' US subsidiaries are not truly independent of their PRC and Hong Kong parents; that FCC action limits what they can sell but cannot remove their equipment, presence or network relationships; and that the investigation found anomalous internet routing activity corresponding with the timing of notable CCP-sponsored hacks against the United States. Among its recommendations is funding for internet routing-security enforcement. Committee report page
The full report, a PDF linked from that page (retained for this profile; it is hosted off the committee's own domain and so is not linked here), develops this into per-carrier routing case studies built on BGP routing updates, subpoenaed records and interviews under oath. In its China Mobile case study the committee reports tracking 58 internet prefixes that it describes as linked to CISA-confirmed Salt Typhoon attacker servers during 22 to 25 September 2024, the four days before the intrusion's public disclosure, and finds that China Mobile International's network appeared in the active routing paths to those servers at least 192 times in eight-hourly checks. The committee states that these patterns do not definitively attribute the underlying cyber campaign to the company. In its China Telecom case study it similarly does not assert that a routing correlation proves the carrier knew of or deliberately participated in the activity. The report carries a classified annex that is not public.
TIR assessment: this is evidence about the routing environment around the 2024 intrusions, not about the actor's tradecraft and not a finding of carrier culpability. Read it alongside the joint advisory's observation that the actors pivot through provider-to-provider and provider-to-customer interconnections: for a telecom defender it argues for knowing which foreign-affiliated networks sit on the paths to and from management and interconnection infrastructure, and for routing-security monitoring, without treating any carrier's presence on a path as attribution of an intrusion.
Access and credentials
Valid credentials first. In Talos's February 2025 investigation, initial access to Cisco devices in every case but one was gained with legitimate victim credentials; how the first credentials were obtained was unknown. In the remaining case there was evidence that CVE-2018-0171 (Cisco Smart Install) was likely abused. Talos found no new Cisco vulnerabilities in the campaign, and it identified no evidence to confirm reports that Salt Typhoon was abusing three other known Cisco vulnerabilities: CVE-2023-20198 and CVE-2023-20273 (IOS XE web UI) and CVE-2024-20399 (NX-OS CLI command injection). Talos also observed pervasive targeting of exposed Smart Install and abuse of CVE-2018-0171 during the same investigation, which it assessed appears unrelated to the Salt Typhoon operations and could not attribute to a specific actor; a CVE-2018-0171 hit is therefore not, by itself, evidence of this actor. Talos investigation
Credential expansion from device configurations. Talos observed the actor exfiltrating device configurations, often over TFTP or FTP, and recovering local accounts stored with weak password types that can be decrypted offline, as well as SNMP read/write community strings. It also observed capture of SNMP, TACACS and RADIUS traffic, including the secret keys shared between devices and their authentication servers, which Talos assesses was almost certainly to enumerate further credentials. Talos investigation
Known vulnerabilities, no zero-days. The joint advisory lists CVE-2024-21887 (Ivanti Connect Secure and Policy Secure, commonly chained after CVE-2023-46805), CVE-2024-3400 (PAN-OS GlobalProtect), CVE-2023-20273 and CVE-2023-20198 (Cisco IOS XE web UI) and CVE-2018-0171 (Cisco Smart Install). It states that exploitation of zero-day vulnerabilities has not been observed, and that initial access vectors remain "a critical information gap" for understanding the activity's scope. The list is explicitly not exhaustive. AA25-239A
Q3 2026. Talos reports that attackers in its telecom espionage engagements routinely gained initial access with valid credentials and by exploiting CVE-2023-20198 in publicly accessible web-based management interfaces, and that victim environments relied on password-only authentication without evidence of MFA, used plaintext SNMP and outdated VPN encryption, and managed credentials poorly. Talos Q3 2026 report
CVE-2023-20198: the vulnerability and this actor's use of it
The vulnerability. Cisco advisory cisco-sa-iosxe-webui-privesc-j22SaA4z (first published 16 October 2023, last updated 1 November 2023, version 2.6, final) covers two issues in the IOS XE web UI. CVE-2023-20198 (CVSS 10.0) was used to create a local user with privilege 15 through the web UI; CVE-2023-20273 (CVSS 7.2) was then used with that account to elevate to root and write an implant to the file system. Devices are affected when the web UI is enabled with ip http server or ip http secure-server; the issues are not exploitable over HTTP or HTTPS respectively when ip http active-session-modules none or ip http secure-active-session-modules none is configured. First fixed releases are 17.9.4a, 17.6.6a, 17.3.8a and 16.12.10a (the last for Catalyst 3650 and 3850). Cisco lists no workaround and recommends disabling the HTTP server feature on internet-facing systems or restricting it to trusted sources; it does not attribute the exploitation it observed to any actor. Cisco advisory
The European Vulnerability Database record EUVD-2023-24377 lists CVE-2023-20198 among its aliases, reproduces Cisco's description of the two-step chain, records exploitation since 16 October 2023 and was last updated on 21 October 2025; the alias was checked on 31 October 2026. A registry entry does not attribute an attack.
This actor's use, case by case. The evidence is not uniform. In the US telecom cases Talos investigated for its February 2025 report, it found no evidence to confirm reported abuse of CVE-2023-20198 or CVE-2023-20273; entry there was by valid credentials, with one likely CVE-2018-0171 case. Talos investigation Three retained sources do report the actor using CVE-2023-20198: the Cyber Centre's mid-February 2025 Canadian case, where likely Salt Typhoon actors exploited CVE-2023-20198 on three devices, retrieved their running configurations and modified at least one to add a GRE tunnel enabling traffic collection; the joint advisory, which describes the actors using the web UI's WSMA endpoints to bypass authentication and create unauthorised administrative accounts, sometimes with double-encoded request paths; and Talos's Q3 2026 telecom engagements, where exploitation of this CVE and valid credentials were the routine entry methods. Cyber threat bulletin, AA25-239A, Talos Q3 2026 report
BadCandy. Talos's section is headed "Salt Typhoon-affiliated threat actors exploit public-facing application vulnerabilities for cyber espionage". Within it, Talos reports that in one Q3 2026 campaign the threat actor deployed BadCandy to maintain persistent remote access, describing it in the body as a malicious web-shell implant known to be leveraged by Salt Typhoon; the report's ATT&CK appendix describes BadCandy as a remote access trojan, so the two descriptions should be read together. Talos does not state in the paragraph that the campaign's actor was Salt Typhoon itself; the heading says "Salt Typhoon-affiliated", and the section covers intrusions attributed to China state-sponsored actors "including" Salt Typhoon. Talos Q3 2026 report
TIR assessment: CVE-2023-20198 has been actively exploited since October 2023 (Cisco's advisory; the EUVD record's exploited-since date is 16 October 2023) and Cisco's advisory names no actor. A device compromised through it is not, on that basis alone, a Salt Typhoon victim; attribution needs the follow-on behaviour (configuration changes, tunnels, AAA redirection, capture) and infrastructure overlap. Conversely, the Canadian case, the joint advisory and the Q3 2026 engagements are sufficient to say this actor uses it in some intrusions, while the February 2025 US cases show it is not the entry method in all of them. Treat the implant and the account created through the vulnerability as separate eviction items: Cisco describes the first step as creation of a local privilege-15 user, which is a configuration change, and none of the retained sources states whether the implant survives a reboot, so neither a reboot nor a patch should be assumed to remove both.
Collection
The joint advisory describes on-device packet capture with native tooling, primarily to capture TACACS+ traffic on TCP port 49 and RADIUS authentication traffic, which may carry credentials in cleartext or weakly protected forms; traffic mirroring through SPAN, RSPAN or ERSPAN; and redirection of a router's TACACS+ server to an actor-controlled address to capture administrators' authentication attempts. In at least one case the TACACS+ shared secret was stored with Cisco Type 7 reversible encoding, which would allow offline decryption of captured TACACS+ payloads. Captured files used names such as mycap.pcap, tac.pcap and 1.pcap. Data targeted includes subscriber information, customer records, network diagrams, configurations and passwords; in at least one instance GRE and MPLS tunnels moved data back to China, and exfiltration used separate channels hidden in high-traffic nodes such as proxies and NAT pools. AA25-239A
Talos documented a custom Go utility, JumbledPath, compiled as an x86-64 ELF binary (which Talos notes makes it usable across many Linux-based network devices), which runs a packet capture on a remote Cisco device through an actor-defined jump host, attempts to clear logs along the path, and returns the compressed, encrypted capture through a further chain of hops. It was found in actor-configured Guest Shell instances on Cisco Nexus devices. Talos investigation
The Canadian case documents collection by configuration change: a GRE tunnel added to a compromised device's configuration, enabling traffic collection from the network. The bulletin's account of call-record theft and collection of a limited number of individuals' private communications is partner reporting relayed by the Cyber Centre, not its own investigation. Cyber threat bulletin
Persistence and privilege on network devices
Reported mechanisms, each with its source:
- Access-control lists adding actor addresses, often named access-list 20, or 50 or 10 when 20 was taken (joint advisory).
- SSH on high non-default ports following 22x22 or xxx22 patterns, with keys added to existing SSH services; HTTP management servers on 18xxx ports (joint advisory). Alternate SSH daemons on high ports, Linux users and authorized_keys entries under root or other users (Talos).
- Loopback address changes used as the SSH source to bypass ACLs on other devices (Talos).
- Guest Shell containers on IOS XE and NX-OS used to stage tools, run Python and native Linux tooling and process collected artefacts, then removed with guestshell disable and guestshell destroy; Talos observed guestshell disable used to restore a normal state (joint advisory, Talos).
- Tunnels over GRE, mGRE or IPsec, sometimes with routing changes (joint advisory); GRE tunnel creation (Talos, Cyber Centre).
- Accounts and AAA: privileged accounts created through the web UI (joint advisory, Talos Q3 2026); AAA settings weakened or the TACACS+ server pointed at actor infrastructure (joint advisory).
- IOS XR host access: the built-in sshd_operns service enabled on TCP/57722, a local user created and granted sudo through /etc/sudoers or /etc/sudoers.d/ to obtain root on the host OS (joint advisory, with the same service noted by Talos).
- Anti-forensics: logging disabled or log forwarding stopped (joint advisory, Talos Q3 2026); .bash_history, auth.log, lastlog, wtmp and btmp cleared (Talos).
- Multi-hop relays with the open-source STOWAWAY tool for C2 and operator access (joint advisory).
Sources: AA25-239A, Talos investigation, Talos Q3 2026 report, Cyber threat bulletin.
TIR assessment: every mechanism above is a feature administrators also use. The investigative question is never "is there a tunnel" but who created it, from which identity, in what change window, to which peer. Where AAA accounting was redirected or disabled, the device's own record of the change is untrustworthy; recover the sequence from off-box flow records, the AAA server's logs and configuration archives held outside the device.
Dwell time and firmware: limits of the evidence
The retained sources give three statements about duration and none gives an average. Talos found access maintained "in one instance for over three years" and describes the campaign's long timeline. The joint advisory describes "persistent, long-term access" with several concurrent access methods, and warns defenders to sequence eviction measures carefully. Talos's Q3 2026 wording is "prolonged" intrusions, with no figures and no intrusion start dates. Talos investigation, AA25-239A, Talos Q3 2026 report
TIR assessment: one three-year case and two qualitative descriptions do not make a dwell-time statistic. Record earliest evidenced access, first configuration change, first capture or tunnel, and discovery as separate clocks per device, and state where telemetry begins after the likely compromise. Do not convert a disclosure date or a vulnerability's publication date into an intrusion start.
Firmware. No retained source reports modification of device firmware or a firmware-resident implant by this actor. The joint advisory recommends firmware hash verification and run-time integrity checks as defensive measures; that is a control, not an observation. The reported persistence lives in running configuration, local accounts, Linux-level users and keys, containers and a non-native implant written to the file system. Treat any claim of firmware implantation as unsupported unless a vendor or government investigation publishes it. AA25-239A
TTPs mapped to reported behaviour
ATT&CK identifiers below are those the joint advisory itself assigns. Where a row's behaviour is reported by Talos or the Cyber Centre without an identifier, the mapping is TIR inference and marked as such. Quarter-wide findings in Talos's Q3 report (initial-access shares, sector rankings, weakness rankings) are not mapped to this actor.
| Reported behaviour | ATT&CK | Source |
|---|---|---|
| Exploitation of known CVEs on internet-facing devices | T1190 | Joint advisory |
| Chaining CVE-2023-20273 after CVE-2023-20198 for root | T1068 | Joint advisory |
| Double-encoded WSMA request paths | T1027.010 | Joint advisory |
| Pivoting over trusted provider interconnections | T1199 | Joint advisory |
| SSH enabled on high ports for encrypted remote access | T1021.004 | Joint advisory |
| GRE, mGRE and IPsec tunnels | T1572 | Joint advisory |
| Staging collected artefacts in Guest Shell | T1560 | Joint advisory |
| Guest Shell removed to clear evidence | T1070.009 | Joint advisory |
| STOWAWAY multi-hop proxies | T1090.003 | Joint advisory |
| Packet capture of TACACS+ and RADIUS | T1040 | Joint advisory |
| TACACS+ server redirected, AAA weakened | T1556 | Joint advisory |
| Port scanning and SPAN/RSPAN mirroring | T1595 | Joint advisory |
| Guest Shell container to evade detection | T1610 | Joint advisory |
| Exfiltration over tunnels and separate C2 channels | T1048.003 | Joint advisory |
| Valid stolen credentials for device login | T1078 (inference) | Talos, February 2025 |
| Cracking weak Type 5 (MD5) or Type 7 passwords from collected configurations | T1003, T1110.002 | Joint advisory (Talos, February 2025, reports the same behaviour) |
| Loopback address changes to bypass ACLs | T1562 (inference) | Talos, February 2025 |
| Clearing Linux logs on devices | T1070 (inference) | Talos, February 2025 |
| GRE tunnel for traffic collection in the Canadian case | T1572 (inference) | Cyber Centre, June 2025 |
Sources: AA25-239A, Talos investigation, Cyber threat bulletin.
Detection
All items are illustrative unless an organisation has tested them against its own device fleet. Each states where the telemetry lives, what it assumes and the likely false positives.
Web UI exploitation (Cisco IOS XE). Cisco's advisory points to %SYS-5-CONFIG_P messages naming the process SEP_webui_wsma_http with new or unknown usernames, %SEC_LOGIN-5-WEBLOGIN_SUCCESS for unexpected users, and %WEBUI-6-INSTALL_OPERATION_INFO for unexpected filenames; it also gives a Talos-supplied HTTP check that returns a hexadecimal string when the implant is present, and Snort rules 3:50118, 3:62527 to 3:62529, 3:62541 and 3:62542. Telemetry: device syslog forwarded off-box; the check runs from a workstation with access to the device. Assumptions: logging was not disabled before the login, and the implant variant still answers the check. False positives: legitimate web UI administration appears in the same messages, so the discriminator is the username and its source address. Cisco advisory
Credential capture. The joint advisory recommends alerting on the creation or start of any on-box packet capture (monitor capture, Embedded Packet Capture) and on SPAN, RSPAN or ERSPAN session definitions, especially those matching TCP/49 or RADIUS, with EEM triggers to syslog the invoking username; and watching for TACACS+ flows to non-approved addresses or leaving the management VRF. Telemetry: AAA command accounting, device syslog, NetFlow/IPFIX from the management VRF. Assumption: command accounting is enforced and its server was not redirected. False positives: packet captures and SPAN sessions created during legitimate troubleshooting; these should be reconcilable with a change record. AA25-239A
Persistence features. The advisory lists SSH on 22x22 or xxx22 ports from non-administrative sources, TCP/57722 listeners or flows on IOS XR, unexpected GRE or other tunnels to foreign infrastructure, unexpected external addresses configured as TACACS+ or RADIUS servers, and non-root accounts granted sudo on XR host Linux; it advises not relying on device syslog alone where Guest Shell exists, but combining syslog, AAA accounting, container logs and off-box flow records. Telemetry: configuration diffs against an archive held outside the device, flow records, host-level audit where the platform exposes it. False positives: management tunnels and monitoring SPAN sessions that are legitimate but undocumented, which is itself a finding. AA25-239A
Talos-reported artefacts. Loopback address changes, authorized_keys additions, alternate sshd instances, Guest Shell enable and disable sequences, and configuration exports over TFTP or FTP to unfamiliar destinations. Telemetry: configuration change records and flow records; Guest Shell events where the platform logs them. Assumption: the baseline configuration is trustworthy, which must be verified rather than assumed where the device was reachable from the internet. Talos investigation
Historical indicators in the 2025 advisory are not reproduced here as a current blocklist; validate time bounds and relevance before operational use.
Mitigation and recovery
- Remove the entry conditions. Upgrade IOS XE to a fixed release and disable or restrict the HTTP server feature on internet-facing devices, per Cisco; patch or decommission devices exposed to CVE-2018-0171 and disable Smart Install with no vstack, per Talos; address the Ivanti and PAN-OS CVEs the joint advisory lists. Cisco advisory, Talos investigation, AA25-239A
- Isolate management. Place SSH, HTTPS, SNMP, TACACS+/RADIUS and file-transfer management services in an out-of-band network or management VRF, and block egress from it except to authorised AAA, syslog and telemetry collectors, as the advisory recommends. Disable sshd_operns on IOS XR and validate at each reboot and upgrade. AA25-239A
- Treat credentials as collected. Where configurations were exported or TACACS+ or RADIUS traffic could have been captured, rotate device accounts, SNMP community strings and AAA shared secrets, and replace weak password types; Talos's investigation shows the actor decrypts them offline. Lock down and monitor the TACACS+ servers and jump hosts themselves. Talos investigation
- Sequence eviction. The advisory warns that these actors keep several access methods at once, so removing one while leaving a tunnel, a redirected AAA server or a Linux-level account intact invites re-entry. Inventory every mechanism in the persistence section across the fleet before acting, and act within one coordinated window. AA25-239A
- Rebuild from a trusted baseline. Restoring a saved configuration can restore an actor's ACL, tunnel or account if the archive post-dates the compromise. Compare against an independently held approved configuration and against vendor integrity checks, including firmware hash verification as a control, before returning a device to service.
Open questions
- Initial access. The joint advisory records initial access vectors as a critical information gap; Talos could not establish how the first credentials were obtained. Which fraction of intrusions begins with a stolen credential rather than an exploit remains unknown. AA25-239A
- Who ran the Q3 2026 BadCandy campaign. Talos heads the section "Salt Typhoon-affiliated threat actors", describes the implant as known to be leveraged by Salt Typhoon, and attributes most, not all, of its telecom intrusions to China state-sponsored actors. Whether that campaign is Salt Typhoon proper, an affiliated cluster, or another China state-sponsored actor is not stated. Talos Q3 2026 report
- Alias boundaries. Microsoft lists FamousSparrow as an other name for Salt Typhoon; ESET tracks FamousSparrow separately because it has no technical indicator linking the two. That is a difference in clustering threshold and available evidence, not a published finding that the groups are distinct, and neither retained page sets out its technical basis. GhostEmperor, RedMike and UNC5807 carry similar uncertainty.
- Implant persistence across reboot. Not stated in the retained sources; eviction should assume both the implant and created accounts must be addressed separately.
- 2026 government reporting. No 2026 joint advisory was found; the House committee report concerns the carriers' infrastructure and routing, not the actor's tradecraft, and its classified annex is unavailable. Statements by individual national authorities during 2026 were seen only in secondary reporting and were not retained; they are not relied on here.
Related TIR coverage
See the lawful-intercept intrusions article for the original US telecom reporting, and the weekly briefing for 23 to 29 March 2026, which records the FCC's Covered List action citing Salt Typhoon among its grounds. This profile uses only the actor-specific section of Talos's Q3 2026 report; its quarter-wide findings are outside the profile's scope.
Sources
- Cisco Talos, IR trends Q3 2026 (29 October 2026): https://blog.talosintelligence.com/ir-trends-q3-2026
- CISA, NSA, FBI and partners, AA25-239A (27 August 2025, revised 3 September 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
- Cisco Talos, Weathering the storm: In the midst of a Typhoon (20 February 2025): https://blog.talosintelligence.com/salt-typhoon-analysis/
- Cisco PSIRT, cisco-sa-iosxe-webui-privesc-j22SaA4z (16 October 2023, updated 1 November 2023): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
- CrowdStrike, Operator Panda adversary profile (undated): https://www.crowdstrike.com/en-us/adversaries/operator-panda/
- Microsoft, How Microsoft names threat actors (updated 21 October 2026): https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming
- Canadian Centre for Cyber Security and FBI, cyber threat bulletin (19 June 2025): https://www.cyber.gc.ca/en/guidance/cyber-threat-bulletin-prc-cyber-actors-target-telecommunications-companies-global-cyberespionage-campaign
- ESET Research, Beware the SparroWock (17 September 2026): https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/
- House Select Committee on the CCP, Stranger Pings: Chinese Telecom Companies Infiltrate U.S. Infrastructure (4 August 2026): https://chinaselectcommittee.house.gov/media/reports/stranger-pings-chinese-telecom-companies-infiltrate-us-infrastructure
- ENISA European Vulnerability Database, EUVD-2023-24377 (record updated 21 October 2025): https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-24377
Version history
Version 1 — 30 October 2026, research updated 31 October 2026: initial profile. The 31 October research pass replaced aggregated ATT&CK material with the underlying investigations (Talos February 2025, AA25-239A, the Cyber Centre bulletin), sourced each alias to its publisher and recorded the ESET disagreement, verified CVE-2023-20198 against Cisco's advisory and the EUVD record, separated the vulnerability's existence from the actor's dated use of it, read Talos's Q3 2026 section for its actor-specific content rather than its quarter-wide statistics, and removed a "since at least 2019" start date that no retained primary source supports. Dwell-time and firmware statements are limited to what the sources say. A second editorial round on 1 November added the House committee's August 2026 report as infrastructure adjacency, named the Cisco CVEs that Talos could not confirm in its February 2025 cases and its assessment that wider Smart Install exploitation was unrelated, corrected the CrowdStrike paraphrase, softened the alias framing to the publishers' own words, and recorded Talos's section heading and both of its BadCandy descriptions.