Natto Thoughts: Salt Typhoon

Who is Salt Typhoon Really? Unraveling the Attribution Challenge

Natto Team — Wed, 24 Sep 2025 16:08:09 GMT

Our previous post about Salt Typhoon provided an initial commentary on the Joint Cybersecurity Advisory on Salt Typhoon issued on August 27, 2025. The advisory identified three Chinese companies - Sichuan Juxinhe Network Technology Co. Ltd. (四川聚信和网络科技有限公司), Beijing Huanyu Tianqiong Information Technology Co., Ltd. (北京寰宇天穹信息技术有限公司), and Sichuan Zhixin Ruijie Network Technology Co., Ltd. (四川智信锐捷网络科技有限公司) - as suppliers of products and services to Salt Typhoon and other overlapping groups such as OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor. After examining these three Chinese companies and their possible roles in Salt Typhoon-related cyber operations, we presented a few questions worth further exploration. In this post, we will address questions about the involvement of Chinese companies in state-sponsored cyber operations and share some observations on threat attribution from the joint advisory.

First, an update: The Company Webpage of Sichuan Zhixin Ruijie is Found

Previously, the…

Salt Typhoon: New Joint Advisory Offers a Beacon Through the Storm but Stirs Up New Questions

Natto Team — Wed, 10 Sep 2025 16:03:20 GMT

Source: ChatGPT image

On August 27, 2025, the United States and 22 government agencies from 13 countries issued a Cybersecurity Advisory entitled, “Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System.” The advisory outlined the tactics, techniques, and procedures (TTPs) employed by advanced persistent threat (APT) actors whose activity partially overlaps with activity grouped under names such as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor.

The document identified three Chinese companies—Sichuan Juxinhe Network Technology Co. Ltd. (四川聚信和网络科技有限公司), Beijing Huanyu Tianqiong Information Technology Co., Ltd. (北京寰宇天穹信息技术有限公司), and Sichuan Zhixin Ruijie Network Technology Co., Ltd. (四川智信锐捷网络科技有限公司)—that have supported these APT activities globally since at least 2021. These organizations reportedly supplied cyber-related products and services to China’s intelligence entities, including units within the People’s Liberat…

Salt Typhoon: the Other Shoe Has Dropped, but Consternation Continues

Natto Team — Wed, 22 Jan 2025 17:02:03 GMT

On January 17, 2025, the United States government imposed sanctions on Sichuan Juxinhe Network Technology Co., LTD (Sichuan Juxinhe) (四川聚信和网络科技有限公司)., a Sichuan-based cybersecurity company, accusing it of “direct involvement in the Salt Typhoon cyber group,” a China-linked cyber threat group. Salt Typhoon, active since at least 2019, has compromised the network infrastructure of multiple major US telecommunication and internet service provider companies. Many in the industry have been expecting attribution and intrusion details for months after the Wall Street Journal first exposed Salt Typhoon in September 2024. Now the question is how Sichuan Juxinhe was involved in the exploitation of these US telecommunication and internet service providers. However, without intrusion details and with sparse publicly available information about the company, It is not easy to pinpoint the connections. Nevertheless, the Natto Team’s preliminary research discovered that Sichuan Juxinhe is likely a fr…

Salt Typhoon: Churning Up a Storm of Consternation

Natto Team — Wed, 20 Nov 2024 20:05:16 GMT

The public first heard the name of Chinese threat actor “Salt Typhoon” on September 25, 2024, when the Wall Street Journal published an article titled “China-Linked Hackers Breach US Internet Providers in New ‘Salt Typhoon’ Cyber Attack.” Many of us were not expecting another typhoon to blow in so quickly. We were still trying to understand Flax Typhoon, which had been revealed barely a week before. Since then, reporting of the Salt Typhoon threat actor has flooded the media. We have been gradually learning the magnitude of the threat actor and its impact. However, as the Natto Team observes how Salt Typhoon stories have unfolded, we have more questions than answers, as we always do.

Typhoon Haiyan October 17, 2001. Source: Defense Visual Information Distribution Service

Salt Typhoon Intrusion Reporting Driven by Media Reports

Unlike most cyber intrusion cases – which are often revealed and tracked by cybersecurity firms based on telemetry data – this time it was a media outlet, the Wal…