BRONZE TIGER

BRONZE TIGER (aka Salt Typhoon) has been active since at least 2019 and has been responsible for numerous compromises of major U.S. telecommunication and internet service provider companies. In January 2025 the U.S. Office of Foreign Assets Control (OFAC) sanctioned Sichuan Juxinhe Network Technology Co., LTD., a Sichuan-based cybersecurity company, and stated it was directly involved in BRONZE TIGER's compromise of the U.S. Treasury Department. The group gained prominence in October 2024 after a Wall Street Journal report that the group had compromised the infrastructure of U.S. Internet Service Providers (ISPs) and potentially stolen sensitive data. The initial access to a target environment is often via vulnerable internet-facing servers/applications that the threat actor can compromise. BRONZE TIGER also use malware families: Cobalt Strike, Demodex, SparrowDoor.