The Phaaaaaaaaantom of the Salt Typhoon is there, inside i-SOON
summary
Claims a reproducible opening in Chinese-sponsored APT Salt Typhoon’s TTPs by mapping domain infrastructure from a 2024 GitHub leak, using passive DNS pivots to reveal name-server IP clusters, reused hosting, shared TLS keys and many domains registered to fake US personas tied to ProtonMail addresses. Shows telecom backbones and multiple state National Guard networks targeted, lists usable IOCs and GitHub-hosted datasets, and demonstrates attribution links between IS0N-linked contractors and Salt Typhoon.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 2:48Passive DNS primer
- 8:51Salt Typhoon overview
- 18:24ISOON leak connections
- 27:17DNS infrastructure analysis
- 33:16Final takeaways and Q&A
related talks
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
32mSomething’s Phishy: See the Hook Before the Bait
47mDNS On Fire
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
22mAPT Attribution and DNS Profiling
28mForecasting Typhoons: Volt Typhoon Next Steps in OT Disruption
34mFollow the Dynamite: Commemorating TeamTNT's Cloud Attacks
30mTales of Red Teaming