⚔️ Salt Typhoon: Zero-Days, DLL Sideloading, and the Return of State-Sponsored Espionage

⚔️ Salt Typhoon: Zero-Days, DLL Sideloading, and the Return of State-Sponsored Espionage

Some cyber threats are loud and messy. Others move like ghosts.
Salt Typhoon is the latter.

Believed to be backed by state-sponsored actors from the People’s Republic of China, this advanced persistent threat (APT) has been quietly embedding itself in global infrastructure since at least 2019 — targeting telecom providers, energy grids, and government networks across more than 80 countries, including the U.S., Europe, the Middle East, and Africa.

🕵️‍♂️ The Threat Actor: Salt Typhoon’s Expanding Shadow

Also tracked under aliases like Earth Estries, GhostEmperor, and UNC2286, Salt Typhoon has evolved into one of the most capable cyber-espionage collectives operating today.

Their methods are textbook APT — blending custom malware, zero-day exploits, and deep persistence mechanisms that can outlast most conventional defenses.

Targets include global-scale organizations using products from Ivanti, Fortinet, and Cisco, giving Salt Typhoon direct access to high-value communications and infrastructure.

Their objective isn’t chaos — it’s control, data, and leverage. This is cyber warfare disguised as network maintenance.

🧩 The European Telecom Incident: Stealth Meets Precision

In mid-2025, Darktrace detected suspicious behavior inside a European telecommunications firm that mirrored Salt Typhoon’s known tactics, techniques, and procedures (TTPs).

The initial compromise appears to have originated through a Citrix NetScaler Gateway zero-day, later spreading to Citrix Virtual Delivery Agent hosts — a familiar pattern for lateral movement.

The Attack Chain

• Initial Access: Compromise via a Citrix edge device, with potential SoftEther VPN obfuscation.

• Persistence: Deployment of a backdoor known as SNAPPYBEE (aka Deed RAT).

• Execution: DLL sideloading using legitimate antivirus binaries (Norton, Bkav, IObit).

• C2 Infrastructure: LightNode VPS servers, dual-channel comms over HTTP and a custom TCP protocol for stealth.

By piggybacking on trusted software, Salt Typhoon ran malicious payloads under the radar — blending in with normal antivirus operations and bypassing traditional endpoint protections.

🧠 The Psychology of Stealth: Hide in Plain Sight

Salt Typhoon doesn’t crash systems; it inhabits them.

DLL sideloading is a subtle art — executing malicious code by injecting it into legitimate software processes. To most security tools, it looks clean. To trained analysts, it’s a fingerprint.

The group’s communication patterns — using Internet Explorer-style headers, odd URI patterns like “/17ABE7F017ABE7F0”, and domains such as aar.gandhibludtric[.]com — are all signs of precision engineering.

Each detail designed to mimic normalcy while maintaining hidden persistence.

🚨 Detection and Containment

Darktrace’s Cyber AI Analyst detected the early-stage intrusion, identifying Salt Typhoon’s backdoor behavior and command-and-control communications before major escalation occurred.

Thanks to rapid detection and AI correlation of events, defenders contained the intrusion — preventing deeper compromise.

But the bigger takeaway isn’t the save.
It’s the lesson: this adversary is learning, adapting, and evolving faster than traditional defense models can keep up.

🔐 The Elliptic Systems Perspective

Salt Typhoon isn’t just another APT — it’s a blueprint for modern, state-backed cyber warfare.

This campaign highlights why behavioral analysis and AI-driven anomaly detection must replace the outdated “signature-based” mindset. If you’re still relying on yesterday’s patterns to detect tomorrow’s threats, you’re already behind.

At Elliptic Systems, our penetration testing and AI consulting services are built for this new reality — helping organizations:

• Identify hidden persistence and lateral movement paths

• Simulate APT-level intrusions safely

• Audit third-party exposure and network segmentation

• Integrate AI-driven behavioral analytics into existing SOC workflows

Because defending against nation-state threats requires more than firewalls — it requires foresight.

👉 Schedule a Cyber Defense Assessment

Salt Typhoon is proof that cyber warfare is no longer theoretical. It’s operational — happening quietly inside global infrastructure right now.

The question isn’t “Will they try to breach us?”
It’s “Will we detect them before they win?”

Stay skeptical. Stay adaptive. Stay ahead.
Elliptic Systems — Security for the Age of AI.