Salt Typhoon used dozens of domains, going back five years. Did you visit one?

Security researchers have uncovered dozens of domains used by Chinese espionage crew Salt Typhoon to gain stealthy, long-term access to victim organizations going back as far as 2020. In a Monday report, threat intelligence firm Silent Push said it had found 45 domains, the majority of which were previously unreported, that it has linked to Salt Typhoon or UNC4841, a similar group. Salt Typhoon is the People's Republic of China spying gang that hacked America's major telecommunications firms and stole metadata and other information belonging to "nearly every American," according to a top FBI cyber official who spoke with The Register about the intrusions. UNC4841 is best known for a series of 2023 attacks that targeted CVE-2023-2868, a critical bug in some Barracuda Email Security Gateways, to deploy custom malware and maintain access to high-value networks, about a third of which belonged to government organizations. The threat researchers note that key domain registration patterns in Salt Typhoon's previously-reported command and control (C2) infrastructure helped them uncover the new domain names, several of which shared the same registrant - "almost certainly fake" personas including "Shawn Francis," "Monica Burch," and "Tommie Arnold," most using ProtonMail email addresses, and all of whom purportedly live in the US and have physical addresses that don't exist. Interestingly, one of the domains appears to be a Hong Kong newspaper: newhkdaily[.]com. "Whether this is an im...