Salt Typhoon / APT28 (GRU)

Intelligence Summary: Salt Typhoon / APT28 (GRU)

Node Identity: Salt Typhoon (also known as APT28, Fancy Bear, or Strontium) is a state-sponsored cyber threat actor group assessed as operating under dual sponsorship from the Chinese Ministry of State Security (MSS) and Russian military intelligence (GRU). The group infiltrated U.S. Internet Service Providers (ISPs) and the Max Planck Institute to map the Gray Track human network supporting FRC/plasma weapons research.

Strategic Relevance: Salt Typhoon's ISP infiltration campaign represents the intelligence preparation phase for adversary kinetic operations against the FRC research community. By compromising U.S. telecommunications infrastructure, the group harvested sociogram data mapping the professional and personal connections of key researchers, program managers, and military officers involved in compact fusion and exotic propulsion programs. This targeting data directly enabled the Valente assassination of Dr. Nuno Loureiro in December 2025. The Max Planck Institute infiltration indicates the campaign extended beyond U.S. borders to map the international FRC research collaboration network.

Technical Focus / Capabilities:

• ISP Infiltration: Compromised U.S. telecommunications infrastructure to intercept communications and map social networks of FRC researchers and defense personnel.
• Sociogram Harvesting: Generated targeting packages from intercepted communications data, identifying key nodes in the Gray Track human network and their interpersonal connections.
• Max Planck Institute Breach: Infiltrated European fusion research institution to map international FRC collaboration networks and identify dual-use technology transfer pathways.
• C2 Infrastructure: Maintained command and control infrastructure overlapping with weaponized Emotet malware, providing deniable operational support for kinetic operators like Valente.
• Cryptocurrency Infrastructure: Darknet escrow nodes for Monero (XMR) payments to kinetic operators, creating a financial pipeline linking cyber intelligence to kinetic operations.

Network Linkage: Salt Typhoon operates as the cyber-intelligence enabler for adversary kinetic actions against the FRC human network. The ISP infiltration campaign provided the targeting data that enabled Valente's strike against Loureiro. The C2 infrastructure overlap with Valente's operational network confirms the cyber-to-kinetic pipeline. PRC MSS operational sponsorship provides resources and political cover, while Russian GRU involvement provides tradecraft and deniable execution capabilities. The Max Planck Institute breach extends the intelligence campaign to European allies, potentially identifying FRC knowledge transfer pathways through international collaboration. The group's activities represent a systematic adversary effort to map, target, and neutralize the human capital underpinning U.S. compact fusion and exotic propulsion programs.