New Infrastructure Discovery: Salt Typhoon (APT) - December 2025 Analysis

-

New Infrastructure Discovery: Salt Typhoon 

(APT) - December 2025 Analysis




Recent telemetry and infrastructure tracking have identified a significant set of new network assets linked to the Chinese cyber-espionage actor known as Salt Typhoon (also tracked as FamousSparrow or GhostEmperor).

This update provides a breakdown of recently observed domains, their operational timeframes, and the low-density IP addresses utilized for Command and Control (C2) or staging operations.

Executive Summary

Salt Typhoon continues to demonstrate a high level of operational security, frequently cycling through low-density IP addresses and utilizing domains that mimic legitimate business or technical services. The infrastructure identified in this report spans from late 2021 through mid-2025, suggesting long-term persistence and planning for various campaign phases.

Infrastructure Breakdown

Below is the detailed list of domains and associated network artifacts.

DomainObservation TimeframeRelated IP Address
asparticrooftop[.]com2022-05-19 to 2023-05-17172.93.165.13
cloudprocenter[.]com2021-10-17 to 2021-11-1992.38.160.50
2021-11-20 to 2021-12-09165.154.230.21
2021-12-10 to 2021-12-14172.93.189.6
2021-12-15 to 2022-06-2891.245.255.13
2022-06-30 to 2022-07-1791.245.255.72
2022-07-18 to 2022-07-2492.38.139.216
2022-08-04 to 2022-08-04172.93.189.207
clubworkmistake[.]com2022-07-13 to 2022-08-10203.20.113.208
2022-08-12 to 2022-08-1696.9.211.4
2022-08-17 to 2024-10-0991.245.255.36
imap[.]dateupdata[.]com2024-08-08 to 2024-10-08193.239.86.168
followkoon[.]com2024-03-14 to 2025-03-13103.113.85.216
aar.gandhibludtric[.]com2025-05-05 to 2025-06-0538.54.63.75
hateupopred[.]com2021-11-12 to 2022-11-08146.70.79.16
infraredsen[.]com2024-12-03 to 2025-06-0545.125.67.144
pop3[.]materialplies[.]com2023-12-12 to 2025-06-05103.159.133.251
newhkdaily[.]com2022-07-21 to 2023-07-19202.146.221.69
pulseathermakf[.]com2022-04-26 to 2022-08-0396.9.211.27
2022-08-04 to 2022-08-17205.189.160.3
2022-08-17 to 2023-09-21146.70.79.105
2023-09-21 to 2025-04-25146.70.79.18
shalaordereport[.]com2022-06-07 to 2022-06-22172.93.165.12
2022-06-23 to 2022-07-25146.70.79.48
toodblackrun[.]com2022-07-21 to 2022-08-17172.93.188.220
2022-08-17 to 2023-11-1423.106.123.183
2023-11-16 to 2024-01-23193.56.255.165
2024-01-25 to 2024-02-0191.245.255.48
2024-02-03 to 2025-06-0391.245.255.50
unfeelmoonvd[.]com2023-02-10 to 2024-01-11165.154.242.73
2024-01-12 to 2024-02-0674.119.193.42
verfiedoccurr[.]com2021-11-17 to 2022-11-1527.255.81.107
waystrkeprosh[.]com2021-12-23 to 2022-12-2196.9.211.15
xdmgwctese[.]com2022-07-16 to 2022-08-16172.93.188.241
2022-08-29 to 2023-10-1091.245.255.32

Analysis and Defense Recommendations




The infrastructure reveals a preference for domains that appear "administrative" or "technical" in nature (e.g., cloudprocenter[.]com, verfiedoccurr[.]com). Many of these assets have been active for years, indicating that Salt Typhoon is successful in maintaining its operational infrastructure over extended periods.

Defensive Actions:

  1. Network Filtering: Block the identified IPs and domains at the perimeter.

  2. DNS Monitoring: Set up alerts for any internal resolution of the listed domains.

  3. Log Analysis: Review historical traffic logs (NetFlow, Web Proxy, DNS) for connections to these indicators during the specified timeframes.

Stay tuned for more updates as I continue to track Salt Typhoon's activity.

Comments

Post a Comment

Popular posts from this blog

Put a safety on that toggle! Automating SAFE Dynamic Mitigation

-
Image
How to Build tuned Profiles for Dynamic Linux Kernel Mitigations dynamic mitigation functionality was created by AMD engineer David Kaplan, linked here is an article discussing it The recent introduction of "Dynamic Mitigations" for the Linux kernel provides a powerful new capability: the ability to enable or disable CPU security mitigations at runtime without a reboot. This is managed by writing to a special file at /sys/devices/system/cpu/mitigations . While you can do this manually with a simple echo command, a more robust and manageable approach is to use the tuned daemon. tuned is a system service designed to switch between performance profiles, making it the perfect tool for this job. This guide will show you how to create custom tuned profiles to easily manage your system's security and performance posture. ​ Start Somewhere : Create a Custom tuned Profile Creating a custom profile is straightforward. First, you need to create a new directory for...
Read more

Tito : Complete In-Memory Toolkit & Methodology.

-
Image
The Stealthy Assassin: An In-Memory Rootkit Philosophy GITHUB REPO WITH ALL RELEVENT FILES A Historical Perspective on Fear and Stealth For those not well-versed in history, one of the most daring letters of all time was sent to Stalin from Josip Broz Tito, the leader of the former Yugoslavia. It read: "Stop sending people to kill me. We've already captured five of them, one of them with a bomb and another with a rifle. If you don't stop sending killers, I'll send one to Moscow, and I won't have to send a second." Knowing Stalin's reputation, few would dare make such a threat. Tito lived to the age of 87, and reports of assassination attempts ended after that letter. He was one of the few who scared Stalin enough to back off. When I considered the stealthy assassin this rootkit could be, only one name came to mind: Tito . The Shift to In-Memory Methodology For a while now, malware has been moving toward an in-memory-only methodology. It is obviously easie...
Read more