How do you defend an organization when attackers live quietly inside your network for years, slipping out and back in through dozens of innocuous-looking domains? That is the dilemma now confronting defenders after researchers revealed a prolonged campaign by a Chinese-linked espionage group known as Salt Typhoon. The group’s sprawling and ever-changing domain infrastructure allowed it to remain stealthy in victim environments as far back as 2020, illustrating how patient, resourceful actors can convert small footholds into long-term intelligence drains.
Salt Typhoon’s Domain Strategy
Researchers tracking the activity say Salt Typhoon registered and rotated dozens of domains to host command-and-control servers, malware staging areas, and secondary access points. This domain-churn strategy made detection and remediation much harder. Domains would be used briefly, then retired and replaced, while subdomains and intermediaries created layers that mimicked benign web traffic. The result: defenders who relied on static blocklists or signature-based detection found their lists obsolete almost as soon as they updated them.
Over roughly a five-year window beginning in 2020, investigators mapped a web of interconnected domains and services tied to Salt Typhoon operations. These assets served multiple roles: initial access redirects, repositories for tooling and compressed archives, and resilient command channels for remote control. By spreading functions across many names and providers, the operators reduced the impact of any single takedown and complicated attribution and response.
Why this matters: the low-and-slow model favored by Salt Typhoon is optimized for espionage. Rather than pursue immediate financial gain, the group prioritized sustained intelligence collection—internal correspondence, schematics, and strategic communications—that accrues value over months or years. For defenders, this kind of persistence introduces three enduring challenges:
– Detection: Domain rotation and plausible hosting patterns defeat traditional, static defenses. Signature-based tools and simple allow/deny lists struggle to keep pace.
– Attribution and takedown: Removing or suspending individual domains is often only a temporary nuisance; operators with a large pool of names can reconstitute infrastructure quickly.
– Incident response complexity: Long dwell times mean exfiltration and reconnaissance can span years, increasing the forensic scope and remediation costs.
Context and parallel incidents
The Salt Typhoon findings arrived amid broader scrutiny of state-linked cyber espionage and follow a pattern seen in other intrusions that exploited email gateway appliances and network edge devices. Nation-state actors have repeatedly taken advantage of unpatched appliances to gain broad visibility into targets and install persistent agents. The confluence of vulnerable appliances, lax patching, and flexible domain-based infrastructure creates a repeatable template for sophisticated espionage campaigns.
What technologists recommend
Security practitioners emphasize layered defenses. Defense-in-depth, continuous monitoring, and robust logging are essential to spot subtle, long-term intrusions. Practical measures include:
– DNS and network logging with long retention windows to reveal historical domain usage.
– Anomaly detection tuned to server-to-server patterns and unusual data flows, not just endpoint alerts.
– Domain reputation and threat-intelligence feeds augmented by human threat-hunting to connect ephemeral activity into a coherent campaign.
– Regular audits and patching of email gateways, VPNs, and other internet-facing appliances.
However, skilled operators adapt. Salt Typhoon’s plausible-traffic patterns and aggressive domain rotation require defenders to combine automation with context-aware analysis and cross-organization intelligence sharing.
Policy implications
Salt Typhoon-style campaigns raise thorny questions for governments. Attribution to state-aligned actors complicates diplomatic responses and highlights the need for cross-border cooperation on takedowns and registrar enforcement. Policymakers must balance naming-and-shaming, sanctions, and technical countermeasures—each with political and collateral consequences. Establishing clearer norms for state behavior in cyberspace and mechanisms for rapid public-private action against malicious infrastructure should be priorities.
Advice for organizations of all sizes
Enterprises should prioritize basic hygiene: multi-factor authentication, least-privilege access, rapid patching of appliances, and rigorous email gateway configurations. Beyond that, organizations should:
– Invest in threat-hunting teams that proactively look for lateral movement and exfiltration indicators.
– Share indicators of compromise (IOCs) across sectors to reduce duplication of effort.
– Consider managed detection and response (MDR) services if internal resources are limited.
Smaller organizations are especially vulnerable because persistent actors often prefer to maintain small, unattended footholds in less defended networks.
Adversary calculus and defender strategies
For Salt Typhoon, the investment in domain infrastructure and patience paid dividends: a single long-standing compromise in a strategically valuable environment can yield intelligence for years. To counter that, defenders should adopt collaborative, intelligence-driven approaches. Legal and operational frameworks that enable faster cross-border takedowns of malicious infrastructure can help, but they bring jurisdictional and free-speech trade-offs that require careful handling.
Open questions and limitations
Public reporting typically lags adversary operations and depends on victim cooperation and forensic visibility. The full scope of Salt Typhoon’s activity may therefore be larger than currently visible. Distinguishing espionage from financially motivated crime can also be difficult when groups borrow techniques from each other. Finally, the effectiveness of domain-based persistence will depend on registrar practices and global cooperation in policing malicious registrations.
Conclusion
Salt Typhoon’s long-term, domain-centric campaign is a stark reminder that cybersecurity increasingly rewards patience and resources. If attackers can live quietly inside networks for years, defenders must accept that resilience requires sustained investment, cross-sector collaboration, and sometimes uncomfortable strategic choices. Salt Typhoon shows that stopping persistence is as much about operational change and global cooperation as it is about a single tool or policy. What new standards of accountability and defense will we adopt to ensure such long dwell times become impossible?
