# Salt Typhoon Earth Estries

Adversary-emulation profile for Salt Typhoon (G1045 / Earth Estries / GhostEmperor /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: DevOps
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill salt-typhoon-earth-estries -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill salt-typhoon-earth-estries -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill salt-typhoon-earth-estries -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill salt-typhoon-earth-estries -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Salt Typhoon (G1045 / Earth Estries / GhostEmperor / FamousSparrow / UNC2286 / RedMike / OPERATOR PANDA), a PRC state-sponsored cyber-espionage actor targeting telecommunications and critical infrastructure worldwide.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Salt Typhoon (Earth Estries, GhostEmperor, FamousSparrow), Adversary Emulation Profile

Salt Typhoon (MITRE ATT&CK **G1045**) is a People's Republic of China (PRC) state-backed cyber-espionage group that has been active since at least 2019, with operations traced back to 2021 targeting network infrastructure worldwide. The group is best known for its sustained, large-scale compromises of major U.S. and global telecommunications providers and ISPs, exploiting edge network devices, particularly Cisco IOS XE routers, for long-term covert access. Salt Typhoon is characterized by its focus on network-layer operations (router compromise, GRE/IPsec tunneling, traffic interception via SPAN/ERSPAN), heavy use of living-off-the-land techniques on network devices, a broad custom malware arsenal (DEMODEX kernel rootkit, GhostSpider modular backdoor, SnappyBee/Deed RAT, Crowdoor, ZINGDOOR, HemiGate, MASOL RAT), and exploitation of N-day vulnerabilities in edge appliances from Cisco, Ivanti, Fortinet, Sophos, and Palo Alto Networks. The group's operations ultimately enable Chinese intelligence services to identify and track targets' communications and movements globally.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/salt-typhoon/SKILL.md