dark-trace · Crawled Jul 25, 2026

Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion

18 IoCs 2 Actors 1 Malware
Read original article ↗

AI Summary

Salt Typhoon, a China-linked advanced persistent threat (APT) group also known as Earth Estries or UNC2286, conducted a cyber espionage intrusion targeting a European telecommunications organization. The attack began with exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances, followed by lateral movement and DLL sideloading using legitimate antivirus software to execute the SNAPPYBEE (Deed RAT) backdoor. Command-and-control communications were observed using suspicious domains and IPs, with activity detected and contained early by Darktrace’s AI-driven systems.

AI-extracted · verify before operational use

Extracted Entities 3 found

Threat Actor GhostEmperor → Threat Actor Earth Estries → Malware SNAPPYBEE →

Indicators of Compromise 18 extracted

Type Value Detail
IP 89[.]31[.]121[.]101 Details →
IP 38[.]54[.]63[.]75 Details →
IP 156[.]244[.]28[.]153 Details →
Domain aar[.]gandhibludtric[.]com Details →
SHA-1 b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 Details →
Filename WINMM.dll Details →
Filename NortonLog.txt Details →
Filename 123.txt Details →
Filename 123.tar Details →
Filename pdc.exe Details →
Filename Dialog.dat Details →
Filename fltLib.dll Details →
Filename DisplayDialog.exe Details →
Filename DgApi.dll Details →
Filename dbindex.dat Details →
Filename 1.txt Details →
Filename imfsbDll.dll Details →
Filename imfsbSvc.exe Details →

MITRE ATT&CK TTPs 23 techniques

T1003.001 LSASS Memory · Credential Access T1021.001 Remote Desktop Protocol · Lateral Movement T1055.001 Dynamic-link Library Injection · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.002 Domain Accounts · Defense Evasion T1087.002 Domain Account · Discovery T1095 Non-Application Layer Protocol · Command And Control T1098.002 Additional Email Delegate Permissions · Persistence T1105 Ingress Tool Transfer · Command And Control T1110.001 Password Guessing · Credential Access T1136.001 Local Account · Persistence T1190 Exploit Public-Facing Application · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1499 Endpoint Denial of Service · Impact T1543.001 Launch Agent · Persistence T1556.004 Network Device Authentication · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1571 Non-Standard Port · Command And Control T1574.001 DLL Search Order Hijacking · Persistence T1665 Hide Infrastructure · Command And Control