GhostEmperor

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat China

Primary Aliases: OPERATOR PANDA Salt Typhoon UNC2286 UNC4841

Sponsor / State Affiliation Chinese State (likely MSS)

Primary Motivation Cyber Espionage and Intelligence Collection (SIGINT)

Active Timeline Unknown – Present

Confidence Rating 90% (Grounded)

US Telecommunications Infrastructure Breach, Edge Device Exploitation Campaign

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Telecommunications Providers Internet Service Providers (ISPs) Government Agencies Critical Infrastructure Lawful Interception/Wiretap Systems

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Execution 1

T1059 Living-off-the-Land (LotL) techniques

Persistence & Privilege Escalation 2

T1547 Persistence through firmware implants

T1547 Lateral movement via hijacked service provider connections

Credential Access & Discovery 1

T1003 Credential Access via administrative protocols

Operational Techniques 2

T1000 Exploitation of Edge Network Devices (Routers, Firewalls)

T1000 Compromise of Lawful Intercept (LI) systems

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] FamousSparrow and SilkParasite: Cross-Platform APT Campaign Targeting Azerbaijani Energy Infrastructure

Attacks and Vulnerabilities 2026-08-20

Copied to clipboard

LINK COPIED TO CLIPBOARD