ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G1045threat actor

Salt Typhoon

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).

MITRE ATT&CK ↗

Linked entities · 15

usesT1685.006Clear Linux or Mac System Logs usesT1590.004Network Topology usesT1572Protocol Tunneling usesT1587.001Malware usesT1048.003Exfiltration Over Unencrypted Non…usesT1098.004SSH Authorized Keys usesT1040Network Sniffing usesT1602.002Network Device Configuration Dump usesT1110.002Password Cracking usesT1021.004SSH usesT1686Disable or Modify System Firewall usesT1588.002Tool usesS1206JumbledPath usesT1136Create Account usesT1190Exploit Public-Facing Application