The group's primary goals are cyber espionage and data exfiltration. Their operations are designed to:

• Steal intellectual property from corporate targets.

• Gather intelligence on government officials and military infrastructure.

• Conduct counterintelligence by infiltrating law enforcement and intelligence systems.

• Pre-position themselves within critical infrastructure for potential future disruption.

Salt Typhoon is a master of "living off the land," using legitimate tools and built-in network utilities to evade detection. Key techniques include:

• Exploiting Vulnerabilities: They frequently exploit known CVEs in firewalls, VPNs, and routers from vendors like Cisco, Palo Alto Networks, and Ivanti.

• Credential Theft: The group uses tools to harvest credentials, often from packet captures of authentication traffic (like TACACS+).

• Lateral Movement: After gaining a foothold, they pivot through networks using compromised credentials and trusted connections between providers.

• Containerization: They have been observed using virtualized containers on network devices (like Cisco's Guest Shell) to hide their tools and activities.

The group follows a methodical process to infiltrate and persist within target networks:

1. Initial Access 

• Exploiting public-facing applications and network edge devices.

2. Persistence 

• Creating new accounts, modifying access control lists (ACLs), enabling SSH on non-standard ports, and creating covert tunnels.

3. Collection 

• Using native packet capture tools on routers to sniff network traffic and modifying TACACS+ server configurations to intercept credentials.

4. Exfiltration 

• Leveraging separate command and control (C2) channels and protocol tunnels (GRE, IPsec) to exfiltrate stolen data.