Salt Typhoon Builds Out Malware Arsenal With GhostSpider

Source: 3D generator via Alamy Stock Photo

The Chinese threat actor known as Salt Typhoon has been spying on some high-value government and telecommunications organizations for several years now, recently debuting fresh backdoor malware, dubbed GhostSpider.

Salt Typhoon (aka Earth Estries, FamousSparrow, GhostEmperor, and UNC2286) is among the People’s Republic’s most cutting advanced persistent threats (APT). In a campaign stretching back to 2023, it has compromised more than 20 organizations. Those organizations tend to be of the highest order, from all corners of the globe, and their breaches have in some cases remained undetected for years. Most recently, it’s been known for targeting US telcos, including T-Mobile USA, and ISPs in North America.

Salt Typhoon’s Arsenal of Malware

With access to a targeted network, the APT that Trend Micro calls Earth Estries can deploy any one of its varied and powerful payloads, which it is consistently building out, according to a new analysis from the firm.

There’s Masol RAT — a cross-platform tool it’s used against Linux servers from Southeast Asian governments — and the modular SnappyBee (aka Deed RAT). The newly discovered GhostSpider, meanwhile, is a highly modular backdoor, adjustable for any particular attack scenario, according to Jon Clay, Trend Micro’s vice president of threat intelligence.

Related:Sneaky Skimmer Malware Targets Magento Sites Ahead of Black Friday

“So, I can enact a specific module to do one specific thing, and it only does that one thing, and then if I need something else, I enact another module. And this does make it much more difficult for defenders and researchers to identify what’s what,” Clay says, because one instance of GhostSpider might look entirely different from another.

Besides its backdoors, the group also possesses a rootkit called Demodex, and Trend Micro has speculated that it might even have used Inc ransomware in some of its operations.

The diversity of Salt Typhoon’s malware may be connected to the very nature of how it operates. According to the researchers, it is a structured organization of distinct, specialized teams. Its various backdoors, for example, are managed by different “infrastructure teams.” The tactics, techniques, and procedures (TTPs) utilized in different attacks might vary significantly, with unique teams focusing in different geographic regions and industries — another reason why pinning down the Chinese APT has been so difficult over the years. “They are very sophisticated [at] gaining access, maintaining access, maintaining persistence, and wiping their tracks when they have done something to make it look like they were never there,” Clay says.

Related:News Desk 2024: Can GenAI Write Secure Code?

How Estries Gains Entry

Earth Estries had been conducting long-term espionage attacks against governments and other targets since 2020. Around the middle of 2022, though, a switch flipped.

“In the past, they were doing a lot of phishing of employees,” Clay recalls. “Now they’re targeting Internet-facing devices using n-day vulnerabilities, finding any open ports [or] protocols, or applications that are running that they can exploit in order to gain access.”

“N-day” refers to recently disclosed bugs that organizations might not have had a chance to patch yet. The group’s favorite vulnerabilities have been dangerous (but now well-documented), including:

• The SQL injection bug CVE-2024-48788, which affects the Fortinet Enterprise Management Server (EMS)

• CVE-2022-3236, a code injection issue in Sophos Firewalls

• The four Microsoft Exchange vulnerabilities involved in ProxyLogon

“And we see this across the board,” Clay notes. “Certainly, emails are still a big way to gain access to organizations, but it used to be 80%-plus [of cases]. I think now you’re looking at a much smaller percentage of these attacks beginning with a phishing campaign.”

Related:Israel Defies VC Downturn With More Cybersecurity Investments

Chinese Island Hopping to Gov’t Cyberattack Victims

Often, Salt Typhoon doesn’t exploit vulnerabilities directly in its target’s network. Instead, it opts for a more tactful approach.

Since 2023, its victims have spanned no fewer than four continents — from countries as diverse as Afghanistan, India, Eswatini, and the US — with the greatest concentration being in Southeast Asia. These organizations have come from the telecommunications, technology, consulting, chemical, transportation, and nonprofit sectors, with a special emphasis on government agencies.

Not all of these organizations are necessarily the hackers’ final destination, though. A nongovernmental organization (NGO), for example, may house interesting data worth stealing, or it might just provide a covert springboard for attacking a more important government agency. In 2023, for instance, researchers observed Salt Typhoon compromising consulting firms and NGOs that work with the US government and military, with the goal of more quickly and effectively breaching the latter.

About the Author

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes “Malicious Life” – an award-winning Top 20 tech podcast on Apple and Spotify – and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts “The Industrial Security Podcast,” the most popular show in its field.