← Feed
@LeeArchinal@ioc.exchange
Post #1845018
2025-07-16 16:03 UTC
Happy Wednesday everyone!
News broke that #SaltTyphoon gained access to the U.S. National Guard's network "and, among other things, collected its network configuration and its data traffic with its counterparts’ networks in every other US state and at least four US territories, according to a DOD report. This data also included these networks’ administrator credentials and network diagrams—which could be used to facilitate follow-on Salt Typhoon hacks of these units."
I am posting this as situational awareness and I never try to strike fear in the community, so I want to remind everyone of the great resources that exist out there when you want to threat hunt or you are trying to detect activity related to different #APT groups or malware! Check out the article posted below and check the comments for resources I would recommend using to supplement your threat hunting or blue team efforts! Enjoy and Happy Hunting!
DHS Salt Typhoon
https://www.documentcloud.org/documents/25998809-20250611-dhs-salt-typhoon/
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
Replies (2)
-
First, we have created a Hunt Package Collection based on hashtag#SaltTyphoon behaviors which you can find here! There is a Community Edition hunt package in there that can get your hunting started!
Salt Tyhpoon Hunt Package Collection
https://hunter.cyborgsecurity.io/research/search?state=(compatible:!f,filters:(actors:!(%27Salt%20Typhoon%27)),library:!(cyborg_collections),page:0,size:10,sort:relevance,term:!(),touched:!t)
#huntoftheday #gethunting
Open ##2478037
-
And of course, another great resource that you can use for your Intel-Driven threat hunting efforts from MITRE ATT&CK. There is enough intel here to create a bunch of different hypotheses and hunt queries!
Salt Typhoon
https://attack.mitre.org/groups/G1045/
#huntoftheday #gethunting
Open ##2478038