Earth Estries is Trend Micro’s name for a PRC state-sponsored cyber-espionage cluster active since at least 2020. Other vendors report overlapping clusters under different names — Salt Typhoon (Microsoft; MITRE G1045), GhostEmperor (Kaspersky), FamousSparrow (ESET) and UNC2286 (Mandiant). The equivalence between these names is disputed: Microsoft treats them as Salt Typhoon aliases, but Trend Micro has said it lacks sufficient evidence to confirm Earth Estries is the same actor behind the U.S. telecom hacks, and ESET keeps FamousSparrow as a distinct intrusion set. We treat the cluster as PRC state-sponsored with high confidence and the name equivalence as a partial, vendor-dependent overlap.
A Note on Names
Earth Estries has no standalone MITRE group ID; Microsoft maps it onto Salt Typhoon (G1045). Media coverage often treats Earth Estries, Salt Typhoon, GhostEmperor and FamousSparrow as interchangeable. The vendor-level evidence supports strong TTP overlap, not a confirmed single identity — so we name the specific reporting behind each claim rather than merging them.
Targeting
Telecommunications — including U.S. telecom and ISP backbone compromises attributed to Salt Typhoon — plus government, technology, consulting, chemical, transportation and NGOs, some tied to the U.S. federal government and military. Trend Micro reported victims across a dozen or more countries in Asia-Pacific, the Americas, the Middle East and Africa.
Notable Campaigns
- 2023: Trend Micro’s initial Earth Estries espionage reporting (Zingdoor, HemiGate, TrillClient; DLL side-loading plus Cobalt Strike).
- Late 2024: the GHOSTSPIDER campaign against telecommunications providers.
- 2024: disclosure of the U.S. telecom intrusions attributed to Salt Typhoon.
- August 2025: a joint CISA/FBI/NSA and partner advisory (AA25-239A) on the targeting of backbone and edge routers.
Malware & Tooling
GHOSTSPIDER (a modular backdoor using a custom TLS-protected protocol), SNAPPYBEE (aka Deed RAT, a suspected ShadowPad successor), MASOL RAT (against Linux government networks), the Demodex rootkit, Zingdoor, HemiGate, TrillClient, and Cobalt Strike. FamousSparrow’s SparrowDoor is part of that lineage and should be cited with the overlap caveat rather than merged outright.
MITRE ATT&CK Mapping
Mapped to the Salt Typhoon group (G1045); verify technique details against the live MITRE page.
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1190 Exploit Public-Facing App | Edge/VPN/firewall exploitation |
| Defense Evasion | T1014 Rootkit | Demodex |
| Defense Evasion | T1574.002 DLL Side-Loading | Backdoor loading |
| Lateral Movement | T1021.004 SSH | Network-device pivoting |
| Command and Control | T1572 Protocol Tunneling | GHOSTSPIDER custom TLS C2 |
Detection & Mitigation
- Prioritise patching internet-facing and edge devices (Ivanti, Palo Alto GlobalProtect, Cisco IOS XE, Fortinet, Sophos, Exchange/ProxyLogon) — the cluster’s primary entry vector — following CISA advisory AA25-239A.
- Monitor network devices and routers for unauthorised configuration changes, SSH
authorized_keysmanipulation and protocol tunneling; retain and centralise often-sparse edge-device logs. - Hunt for Demodex rootkit artefacts, DLL side-loading and GHOSTSPIDER’s custom-TLS beaconing; enforce MFA and segment management planes.
Defend Telecom and Edge Infrastructure
Mjolnir Security helps organisations harden edge devices and hunt backbone-telecom intrusions.
- Managed Detection and Response Monitoring edge devices and routers for rootkits and tunneling.
- Attack Surface Management Finding and patching exposed edge and VPN appliances.
- 24/7 Incident Response Containment when telecom-grade espionage is suspected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts