Salt Typhoon hackers backdoor telcos with new GhostSpider malware

Salt Typhoon (aka UNC2286) is a sophisticated Chinese state‑sponsored APT observed by Trend Micro mounting global espionage campaigns against telecommunications and government targets using a modular in‑memory backdoor called GhostSpider, multiple additional backdoors/rootkits (Masol RAT, Demodex, SnappyBee), and exploitation of public‑facing CVEs (e.g., Ivanti, Fortinet, Sophos, Microsoft Exchange) for initial access; the report documents active breaches, large-scale impact (including intercepted communications of U.S. officials), and a multi-stage, stealthy toolchain enabling prolonged access and data exfiltration.