GhostEmperorThreat actor
- FamousSparrow
- operator panda
- redmike
- Salt Typhoon
- unc2286
GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection.From MISP Galaxy
Last reported 5 days ago, by SecurityWeek25 reports
ATT&CK techniques
6 of 60 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“ICS now also includes the Command and Scripting Interpreter Technique, with sub-techniques for six interpreters, replacing the deprecated Command-Line Interface and Scripting techniques.”
- T1684Social Engineering
“Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“T1027.007”
- T1033System Owner/User Discovery
“T1033”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
25 reports · the newest 20, newest first · the exact sentence from each-
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks“China-backed Salt Typhoon’s entry now covers its exploitation of network edge devices, while the entry for North Korea’s APT38 reflects a shift from financial theft to software supply chain attacks.”
-
September 2026 Threat Trend Report on APT Groups“FamousSparrow, Fire Ant, Storm-3069, UAT-11587, and UTA0565 actively exploited trusted infrastructure and legitimate Services.”
-
EU’s hodgepodge tech policy exposes members to Chinese vendor risks, says think tank“Remember, Salt Typhoon’s high-profile attack on US telco networks took place as recently as 2024.”
-
MI5 Warns Over 100 Academics Helped China's Espionage Plans“…including many hackers that have been responsible for some of China’s most audacious campaigns, via ‘groups’ such as Silk Typhoon and Salt Typhoon.”
-
The 2026 U.S. Midterms Election Season, Weakened Defenses: The Cyber Landscape Ahead“China’s Salt Typhoon campaign demonstrated that even the most sensitive U.S.”
-
Citrix Patches Critical Zero Days Under Active Exploitation“It’s not clear who is behind the exploitation attempts but in 2025, a cyber intrusion linked to China-based group Salt Typhoon targeted a Citrix zero day.”
-
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions“Once inside, the Salt Typhoon cluster implanted malicious code on network devices and configured GRE tunnels to pull data through compromised routers.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“…oups have been seen exploiting TACTACS+ over the past two years in operations targeting telecommunications companies across the world—Salt Typhoon and Fire Ant.”
-
Bipartisan Senate leaders introduce bill to bolster telecom cybersecurity in response to Salt Typhoon hacks“Bipartisan Senate leaders introduce bill to bolster telecom cybersecurity in response to Salt Typhoon hacks”
-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“…les to prevent hacks: T-Mobile staff had to physically cut an internet cable to a compromised system to prevent Chinese hacking group Salt Typhoon from moving further into its network.”
-
Risky Bulletin: Gemini hacked three companies too“FamousSparrow hits LATAM: Since August of last year, the FamousSparrow APT group has shifted targeting to go after governmental organizations in Latin America.”
-
China's FamousSparrow APT Spies on US Politics in Latin America“China's FamousSparrow APT Spies on US Politics in Latin America”
-
China's Salt Typhoon backdoors Latin American orgs with new snooping malware“China's Salt Typhoon backdoors Latin American orgs with new snooping malware”
-
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor“FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor”
-
FamousSparrow centra sus operaciones en América Latina y despliega el nuevo backdoor SparroWocky“FamousSparrow centra sus operaciones en América Latina y despliega el nuevo backdoor SparroWocky”
-
Reporte de Actividad APT del cuarto trimestre de 2025 al primero de 2026“En un caso destacado, FamousSparrow apuntó a una entidad gubernamental venezolana relacionada con asuntos marítimos, probablemente para monitorear la resiliencia de los envíos de petróleo tras la intervención de estadounidense.”
-
U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026“Nation-State Threats: Salt Typhoon Breaches Congress”
-
Cómo las PyMEs utilizan la investigación de amenazas y los servicios MDR para fortalecer su ciberdefensa“Un ejemplo que él ha mencionado es un ataque que involucra a FamousSparrow.”
-
How SMBs use threat research and MDR to build a defensive edge“An example he has used is an attack involving FamousSparrow.”
-
GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks“GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- third-party[.]comin 1 report
- 104.194.9[.]227in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.