{
 "Event": {
  "uuid": "91156f08-77d1-56e9-a07f-3cdbff47a209",
  "info": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
  "date": "2024-09-15",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"espionage\""
   },
   {
    "name": "misp-galaxy:threat-actor=\"GhostEmperor\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"philippines\""
   },
   {
    "name": "misp-galaxy:country=\"thailand\""
   },
   {
    "name": "misp-galaxy:country=\"australia\""
   },
   {
    "name": "misp-galaxy:country=\"indonesia\""
   },
   {
    "name": "misp-galaxy:country=\"taiwan\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:sector=\"Telecommunications\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   },
   {
    "name": "misp-galaxy:sector=\"Defense\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": {
     "title": "CISA Advisory AA24-340A",
     "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
    },
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": {
     "title": "Microsoft Threat Intelligence",
     "url": "https://www.microsoft.com/en-us/security/blog/"
    },
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}