Salt Typhoon / APT28 (GRU)
ID: SaltTyphoon
Summary
State-sponsored cyber threat actors (PRC MSS / Russian GRU). Infiltrated U.S. ISPs and Max Planck Institute to map the Gray Track human network.
Intelligence Analysis
Intelligence Summary: Salt Typhoon / APT28 (GRU)
Classification: Composite state-sponsored cyber threat actor designation encompassing PRC Ministry of State Security (MSS) ISP infiltration operations ('Salt Typhoon') and Russian military intelligence (GRU Unit 26165 / APT28) cyber-kinetic targeting infrastructure.
Operations:
- Infiltrated major U.S. Internet Service Providers to harvest communications metadata
- Penetrated Max Planck Institute networks to map the 'human connective tissue' of the Gray Track academic ecosystem
- Generated sociogram targeting packages used to identify and prioritize high-value human capital nodes
- Provided Command and Control (C2) infrastructure and weaponized Emotet malware to kinetic operators
Impact: The Salt Typhoon sociogram mapping directly enabled the identification and targeting of Dr. Nuno Loureiro as a critical single-point-of-failure.
Key Findings
- ▸ Classification: Composite state-sponsored cyber threat actor designation encompassing PRC Ministry of State Security (MSS) ISP infiltration operations ('Salt Typhoon') and Russian military intelligence (GRU Unit 26165 / APT28) cyber-kinetic targeting infrastructure.
- ▸ Infiltrated major U.S. Internet Service Providers to harvest communications metadata
- ▸ Penetrated Max Planck Institute networks to map the 'human connective tissue' of the Gray Track academic ecosystem
- ▸ Generated sociogram targeting packages used to identify and prioritize high-value human capital nodes
- ▸ Provided Command and Control (C2) infrastructure and weaponized Emotet malware to kinetic operators
Network Linkage
- Cláudio Valente — Cyber-financial targeting support for kinetic strike
- Dr. Nuno Loureiro — Primary target identified via sociogram mapping
- Max Planck Institute — Infiltrated to map Gray Track academic network
- PRC / MSS — Salt Typhoon operational sponsor
- GRU Unit 26165 — APT28 C2 infrastructure provider
Related Entities (2)
Network Graph
Explore Salt Typhoon / APT28 (GRU) and its connections in the interactive network graph.
View in Network GraphGlossary Definition
State-sponsored cyber threat actors (PRC MSS / Russian GRU). Infiltrated U.S. ISPs and Max Planck Institute to map the Gray Track human network.
Category: Organizations View in Glossary →Research References
Search the research archive for documents and investigations related to Salt Typhoon / APT28 (GRU).
Search Research ArchiveCountry Analysis
This entity appears in the following country-specific network graphs: