Who is Salt Typhoon, GhostEmperor?

Salt Typhoon, GhostEmperor is a threat actor attributed to CN, also known as Salt Typhoon, GhostEmperor, UNC2286. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Salt Typhoon, GhostEmperor exploit?

Specific CVE exploitation data for Salt Typhoon, GhostEmperor is being tracked. Check the Strobes VI threat actor profile for updates.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Salt Typhoon, GhostEmperor

Also known as: Salt Typhoon, GhostEmperor, UNC2286, FamousSparrow, Earth Estries, RedMike, Operator Panda, OPERATOR PANDA

CNInformation theft and espionage

Exploited CVEs

Overview

GhostEmperor is a Chinese-speaking threat actor that has mostly focused on targets in Southeast Asia, including several government entities and telecom companies. The group stands out because it uses a formerly unknown Windows kernel-mode rootkit. Rootkits provide remote control access over the servers they target. Acting covertly, rootkits are notorious for hiding from investigators and security solutions. To bypass the Windows Driver Signature Enforcement mechanism, GhostEmperor uses a loading scheme involving a component of an open-source project named “Cheat Engine.” This advanced toolset is unique and Kaspersky researchers see no similarity to already known threat actors. Kaspersky experts have surmised that the toolset has been in use since at least July 2020.

Exploited Vulnerabilities

No exploited CVEs have been attributed to this threat actor yet.

Browse CVE Database