Here is the original report by Darktrace: Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion
Cybersecurity programs typically focus on protecting core applications and digital assets. But what if the bad guys start targeting trusted defensive measures?
This was the case as reported by Darktrace, a cybersecurity platform provider. Its report sheds light on a sophisticated cyber intrusion linked to Salt Typhoon. The threat actor group is believed to be operated by China's Ministry of State Security, which conducts cyber espionage campaigns against other countries.
The recent attack features a blend of zero-day exploitation and trusted software abuse. In this instance, Salt Typhoon infiltrated a European telecommunications provider through a gateway device. The attackers then executed a familiar—but evolving—arsenal of stealth techniques. These included DLL sideloading and abusing trusted antivirus software—such as Norton, Bkav, and IObit—to mask malicious payloads under legitimate binaries. The campaign also deployed a custom backdoor known as SNAPPYBEE (aka Deed RAT) by using a dual command-and-control channel (HTTP and unidentified TCP) to sustain the covert access.
Darktrace analysts attribute the incident to Salt Typhoon based on overlapping tactics, infrastructure, and malware patterns seen in prior operations by the group. The event underscores a growing trend: nation-state actors are increasingly weaponizing legitimate tools and supply-chain software to bypass traditional security controls and AI-powered detection.
...
Given the current geopolitical relationship between the US and China, attacks like this are sure to keep occurring. The two countries compete in world markets. Plus, mutual distrust exists across economic, technological, and military domains.
This campaign also symbolizes broader China-linked cyber operations targeting telecom and communications infrastructure as part of its strategic intelligence-gathering efforts.
“Organizations should expect stealthy activity that blends with normal operations when facing Salt Typhoon,” said Jason Soroko, a Senior Fellow at Sectigo, a provider of comprehensive certificate lifecycle management.”
As this attack illustrates, there has been a shift toward stealth-driven espionage. Attackers now rely less on malware volume. Their focus has turned to exploiting the trust woven into enterprise systems. The time has arrived to apply the zero-trust paradigm to cybersecurity defenses.