Natto Thoughts: Salt Typhoon

Who is Salt Typhoon Really? Unraveling the Attribution Challenge

Natto Team — Wed, 24 Sep 2025 16:08:09 GMT

Note added May 27, 2026

On May 2, 2026, The Cyber Defense Review published an article, “China’s Cyber Explosives Are in Place. Where’s Our Response?,” written by Rob Joyce, former Acting Homeland Security Adviser on the U.S. National Security Council and retired NSA cybersecurity director. In the article, Joyce argues that China’s cyber campaigns—such as Volt Typhoon and Salt Typhoon—“are not routine espionage, but deliberate preparations for conflict. These operations reflect a coordinated effort to pre-position access across vital systems, enabling the potential disruption of military logistics and civilian infrastructure in the early stages of a crisis.” Joyce’s argument—that Salt Typhoon’s activities were intended to pre-position for conflict—is new to the Natto Team.

As the Natto Team’s previous analysis indicated, Volt Typhoon was known for cyber campaigns focused on developing capabilities and preparing and pre-positioning for possible disruptive and destructive attacks. By contr…

Salt Typhoon: New Joint Advisory Offers a Beacon Through the Storm but Stirs Up New Questions

Natto Team — Wed, 10 Sep 2025 16:03:20 GMT

Source: ChatGPT image

On August 27, 2025, the United States and 22 government agencies from 13 countries issued a Cybersecurity Advisory entitled, “Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System.” The advisory outlined the tactics, techniques, and procedures (TTPs) employed by advanced persistent threat (APT) actors whose activity partially overlaps with activity grouped under names such as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor.

The document identified three Chinese companies—Sichuan Juxinhe Network Technology Co. Ltd. (四川聚信和网络科技有限公司), Beijing Huanyu Tianqiong Information Technology Co., Ltd. (北京寰宇天穹信息技术有限公司), and Sichuan Zhixin Ruijie Network Technology Co., Ltd. (四川智信锐捷网络科技有限公司)—that have supported these APT activities globally since at least 2021. These organizations reportedly supplied cyber-related products and services to China’s intelligence entities, including units within the People’s Liberat…

Salt Typhoon: the Other Shoe Has Dropped, but Consternation Continues

Natto Team — Wed, 22 Jan 2025 17:02:03 GMT

On January 17, 2025, the United States government imposed sanctions on Sichuan Juxinhe Network Technology Co., LTD (Sichuan Juxinhe) (四川聚信和网络科技有限公司)., a Sichuan-based cybersecurity company, accusing it of “direct involvement in the Salt Typhoon cyber group,” a China-linked cyber threat group. Salt Typhoon, active since at least 2019, has compromised the network infrastructure of multiple major US telecommunication and internet service provider companies. Many in the industry have been expecting attribution and intrusion details for months after the Wall Street Journal first exposed Salt Typhoon in September 2024. Now the question is how Sichuan Juxinhe was involved in the exploitation of these US telecommunication and internet service providers. However, without intrusion details and with sparse publicly available information about the company, It is not easy to pinpoint the connections. Nevertheless, the Natto Team’s preliminary research discovered that Sichuan Juxinhe is likely a fr…

Salt Typhoon: Churning Up a Storm of Consternation

Natto Team — Wed, 20 Nov 2024 20:05:16 GMT

The public first heard the name of Chinese threat actor “Salt Typhoon” on September 25, 2024, when the Wall Street Journal published an article titled “China-Linked Hackers Breach US Internet Providers in New ‘Salt Typhoon’ Cyber Attack.” Many of us were not expecting another typhoon to blow in so quickly. We were still trying to understand Flax Typhoon, which had been revealed barely a week before. Since then, reporting of the Salt Typhoon threat actor has flooded the media. We have been gradually learning the magnitude of the threat actor and its impact. However, as the Natto Team observes how Salt Typhoon stories have unfolded, we have more questions than answers, as we always do.

Typhoon Haiyan October 17, 2001. Source: Defense Visual Information Distribution Service

Salt Typhoon Intrusion Reporting Driven by Media Reports

Unlike most cyber intrusion cases – which are often revealed and tracked by cybersecurity firms based on telemetry data – this time it was a media outlet, the Wal…