Mastodawn

FamousSparrow / SparrowDoor static analysis.
Legacy variant (2019-2022), SHA256: 8dfaa1f579...

4 findings not present in public vendor reporting
at time of analysis (ESET, UK NCSC, Trend Micro, Microsoft)

→ Inverted anti-sandbox logic
→ Three-table substitution system
→ .text section entropy anomaly
→ 113 indirect call sites in 26KB binary

Thread: [PHIM] findings only.
Full report: https://github.com/seraphimdeck/SerapHim-CTI

#FamousSparrow #SaltTyphoon #MalwareAnalysis #CTI

GitHub - seraphimdeck/SerapHim-CTI: A collection of independent CTI reports covering active threat campaigns and attacker TTPs.

A collection of independent CTI reports covering active threat campaigns and attacker TTPs. - seraphimdeck/SerapHim-CTI

GitHub

The New Oil Mar 11

#SaltTyphoon is hacking the world’s phone and internet giants — here’s everywhere that’s been hit

https://techcrunch.com/2026/03/09/salt-typhoon-china-who-has-been-hacked-global-telecom-giants/

#cybersecurity #China

Salt Typhoon is hacking the world's phone and internet giants — here's everywhere that's been hit | TechCrunch

Salt Typhoon is by far one of the most prolific hacking groups in recent years, breaching some of the top American phone companies. Here are all the countries that have been targeted.

TechCrunch

Kimbo106 Mar 11

FBI : quand un réseau de surveillance entre dans la zone grise du cyber

Le FBI enquête sur des activités suspectes détectées en février 2026 sur un système sensible de son réseau. Derrière l’alerte, une question plus vaste s’impose.

Que se passe-t-il lorsque les outils conçus pour écouter, capter et documenter deviennent eux-mêmes vulnérables ?
L’incident dépasse le seul fait divers. Il touche à la sécurité intérieure, à la souveraineté numérique et à l’équilibre des puissances.
Dans un monde traversé par les rivalités, et pas seulement cyber, les dispositifs de surveillance ne sont plus seulement des instruments. Ils sont devenus des cibles stratégiques. Ils permettent de voir sans être vu.

https://librexpression.fr/quand-les-reseaux-de-surveillance-deviennent-des-cibles

#APT41 #CISA #cyberattack #databreaches #DGSN #DHS #FBI #informatique #librexpression #penregister #RPC #salttyphoon #threats #USA #warfare #wiretaps

(Crédits : Markus Winkler/Pexels)

Martin Reitsma Mar 10

Salt Typhoon is hacking the world’s phone and internet giants. Here’s everywhere that’s been hit.
Salt Typhoon is hacking the world’s phone and internet giants. Here’s everywhere that’s been hit.
#Salttyphoon

https://opr.news/63a132d1260309en_us?link=1&client=ex_global

Download Now
https://opr.as/share

Salt Typhoon is hacking the world’s phone and internet giants. Here’s everywhere that’s been hit.

Salt Typhoon is behind one of the broadest hacking campaigns in recent years, targeting some of the world’s largest phone and internet companies and stealing tens of millions of phone records about senior government officials. The hacking group, attributed to China, is part of a wider cluster of hackers with the collective aim of helping China prepare for an eventual war with Taiwan, according to researchers.

opera news app

Show thread

Fossman Mar 2

@as400 @khalid @postmarketOS I'm daily driving a #Librem5 with #postmarketOS and I've tested reliable voice calling successfully with multiple carriers in two counties. Also, tested with #PureOS.

Owners of older units may need to upgrade modem firmware and enable VoLTE manually. The real problem in my limited knowledge is carriers are blocking devices which are not on their 'approved list' or which they think are not VoLTE capable.

Another, bigger questions is: why are people still using unencrypted legacy voice calls for personal communications in 2026?

#SaltTyphoon

IAintShootinMis Feb 23

Watching talks on AI and Security at NTCA RTime this week. Wondering what if anything the co-ops are going to have to say about #CALEA and #SaltTyphoon

Any questions I should ask the presenters?

Maybe what, if any, help they're getting from #CISA

#Telecom

PrivacyDigest Feb 10

Senator says #ATT , #Verizon blocking release of #SaltTyphoon #security assessment reports-Reuters

Dem Sen #Cantwell said Verizon & AT&T are blocking release of key docs about an alleged massive #Chinese #spying operation that infiltrated US #telecom networks known as Salt Typhoon & wants their CEOs to appear before Congress to answer questions

Cantwell asked both companies to turn over security assessments conducted by Alphabet #cybersecurity unit #Mandiant
#privacy

https://www.reuters.com/business/media-telecom/senator-says-att-verizon-blocking-release-salt-typhoon-security-assessment-2026-02-03/

#cryptohagen Feb 9

Norge 🇳🇴 har bekræftet, at den kinesiske 🇨🇳 #SaltTyphoon har hacket virksomheder i landet

Gruppen er kendt for at have hacket store amerikanske 🇺🇸 tele-selskaber i 2024

Det er almindeligt antaget, at den samme kampagne har påvirket tele-selskaber over hele verden
https://therecord.media/norawy-intelligence-discloses-salt-typhoon-attacks

Norwegian intelligence discloses country hit by Salt Typhoon campaign

The assessment said Chinese security and intelligence services have strengthened their ability to operate in Norway, including through cyber operations and human intelligence collection.

The New Oil Feb 9

#China’s #SaltTyphoon hackers broke into Norwegian companies

https://techcrunch.com/2026/02/06/chinas-salt-typhoon-hackers-broke-into-norwegian-companies/

#Norway #cybersecurity

China's Salt Typhoon hackers broke into Norwegian companies | TechCrunch

Norway's government accused China’s Salt Typhoon hacking group of conducting a cyberespionage campaign in the country.

TechCrunch

TechNadu Feb 7

Norway’s PST has confirmed Salt Typhoon activity affecting Norwegian organizations, citing exploitation of vulnerable network devices within critical infrastructure environments.

The 2026 assessment frames cyber operations as China’s primary intelligence vector, while noting that Russia remains the most significant overall threat due to sustained espionage, infrastructure mapping, and hybrid operations. The report reinforces the convergence of cyber tradecraft with influence and HUMINT activity.

For defenders, the findings highlight the importance of network device visibility, cross-sector intelligence sharing, and long-term monitoring.

💬 What defensive gaps does this assessment expose?

🔔 Follow TechNadu for ongoing threat intelligence reporting

#ThreatIntelligence #SaltTyphoon #NationStateThreats #CriticalInfrastructure #CyberDefense #InfoSec #TechNadu