Salt Typhoon / APT28 (GRU) // Intelligence Entity

Summary

State-sponsored cyber threat actors (PRC MSS / Russian GRU). Infiltrated U.S. ISPs and Max Planck Institute to map the Gray Track human network.

Intelligence Analysis

Intelligence Summary: Salt Typhoon / APT28 (GRU)

Classification: Composite state-sponsored cyber threat actor designation encompassing PRC Ministry of State Security (MSS) ISP infiltration operations ('Salt Typhoon') and Russian military intelligence (GRU Unit 26165 / APT28) cyber-kinetic targeting infrastructure.

Operations:

Infiltrated major U.S. Internet Service Providers to harvest communications metadata
Penetrated Max Planck Institute networks to map the 'human connective tissue' of the Gray Track academic ecosystem
Generated sociogram targeting packages used to identify and prioritize high-value human capital nodes
Provided Command and Control (C2) infrastructure and weaponized Emotet malware to kinetic operators

Impact: The Salt Typhoon sociogram mapping directly enabled the identification and targeting of Dr. Nuno Loureiro as a critical single-point-of-failure.

Key Findings

▸ Classification: Composite state-sponsored cyber threat actor designation encompassing PRC Ministry of State Security (MSS) ISP infiltration operations ('Salt Typhoon') and Russian military intelligence (GRU Unit 26165 / APT28) cyber-kinetic targeting infrastructure.
▸ Infiltrated major U.S. Internet Service Providers to harvest communications metadata
▸ Penetrated Max Planck Institute networks to map the 'human connective tissue' of the Gray Track academic ecosystem
▸ Generated sociogram targeting packages used to identify and prioritize high-value human capital nodes
▸ Provided Command and Control (C2) infrastructure and weaponized Emotet malware to kinetic operators

Network Linkage

Cláudio Valente — Cyber-financial targeting support for kinetic strike
Dr. Nuno Loureiro — Primary target identified via sociogram mapping
Max Planck Institute — Infiltrated to map Gray Track academic network
PRC / MSS — Salt Typhoon operational sponsor
GRU Unit 26165 — APT28 C2 infrastructure provider

Related Entities (2)

Cláudio Manuel Neves Valente

PERSON

→ Cyber/Financial Targeting Support

Dossier Main Graph

PRC FRC Program (CAEP/CAS)

ORGANISATION

→ MSS Operational Sponsor

Dossier Main Graph

Network Graph

Explore Salt Typhoon / APT28 (GRU) and its connections in the interactive network graph.

View in Network Graph

Research References

Search the research archive for documents and investigations related to Salt Typhoon / APT28 (GRU).

Search Research Archive

Frequently Asked Questions

What is Salt Typhoon / APT28 (GRU)? ▾

State-sponsored cyber threat actors (PRC MSS / Russian GRU). Infiltrated U.S. ISPs and Max Planck Institute to map the Gray Track human network.

What is Salt Typhoon / APT28 (GRU) connected to? ▾

Salt Typhoon / APT28 (GRU) is directly connected to 2 entities in the network graph, including Cláudio Manuel Neves Valente, PRC FRC Program (CAEP/CAS). These connections represent documented relationships such as Cyber/Financial Targeting Support, MSS Operational Sponsor. Explore the full network using the interactive graph for complete relationship mapping.

Where can I find more details about Salt Typhoon / APT28 (GRU)? ▾

A full intelligence dossier is available for Salt Typhoon / APT28 (GRU), including 0 source documents, deep-dive analysis, and network linkage assessment. Visit the dossier page for the complete profile.

How does Salt Typhoon / APT28 (GRU) fit into the broader network? ▾

* **Cláudio Valente** — Cyber-financial targeting support for kinetic strike * **Dr. Nuno Loureiro** — Primary target identified via sociogram mapping * **Max Planck Institute** — Infiltrated to map Gray Track academic network * **PRC / MSS** — Salt Typhoon operational sponsor * **GRU Unit 26165** —...