dark-trace · Crawled Jul 25, 2026
Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion
18 IoCs 2 Actors 1 Malware
Read original article ↗
AI Summary
Salt Typhoon, a China-linked advanced persistent threat (APT) group also known as Earth Estries or UNC2286, conducted a cyber espionage intrusion targeting a European telecommunications organization. The attack began with exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances, followed by lateral movement and DLL sideloading using legitimate antivirus software to execute the SNAPPYBEE (Deed RAT) backdoor. Command-and-control communications were observed using suspicious domains and IPs, with activity detected and contained early by Darktrace’s AI-driven systems.
AI-extracted · verify before operational use
Extracted Entities 3 found
Indicators of Compromise 18 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 89[.]31[.]121[.]101 | Details → |
| IP | 38[.]54[.]63[.]75 | Details → |
| IP | 156[.]244[.]28[.]153 | Details → |
| Domain | aar[.]gandhibludtric[.]com | Details → |
| SHA-1 | b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 | Details → |
| Filename | WINMM.dll | Details → |
| Filename | NortonLog.txt | Details → |
| Filename | 123.txt | Details → |
| Filename | 123.tar | Details → |
| Filename | pdc.exe | Details → |
| Filename | Dialog.dat | Details → |
| Filename | fltLib.dll | Details → |
| Filename | DisplayDialog.exe | Details → |
| Filename | DgApi.dll | Details → |
| Filename | dbindex.dat | Details → |
| Filename | 1.txt | Details → |
| Filename | imfsbDll.dll | Details → |
| Filename | imfsbSvc.exe | Details → |
MITRE ATT&CK TTPs 38 techniques
T1003 OS Credential Dumping · Credential Access T1003.001 LSASS Memory · Credential Access T1013 T1013 T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1048 Exfiltration Over Alternative Protocol · Exfiltration T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1074 Data Staged · Collection T1078 Valid Accounts · Defense Evasion T1078.002 Domain Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1098.002 Additional Email Delegate Permissions · Persistence T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1110.001 Password Guessing · Credential Access T1120 Peripheral Device Discovery · Discovery T1133 External Remote Services · Persistence T1136.001 Local Account · Persistence T1190 Exploit Public-Facing Application · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1482 Domain Trust Discovery · Discovery T1499 Endpoint Denial of Service · Impact T1543.001 Launch Agent · Persistence T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1556.004 Network Device Authentication · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1571 Non-Standard Port · Command And Control T1574.001 DLL Search Order Hijacking · Persistence T1574.002 DLL Side-Loading · Persistence T1665 Hide Infrastructure · Command And Control