GhostEmperor
GhostEmperor is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 48 countries, including the United States and the United Kingdom. It uses 140 MITRE ATT&CK techniques and exploits 47 known CVEs.
- FamousSparrow
- Earth Estrie
- UNC2286
- RedMike
- Earth Estries
- OPERATOR PANDA
- Salt Typhoon
- Origin
- China
- Techniques
- 140
- Exploited CVEs
- 47
- First seen
- Jan 1, 2019
- Last seen
- Feb 20, 2025
- Record updated
Who They Target.
About GhostEmperor.
GhostEmperor is a Chinese state-sponsored cyberespionage cluster, tracked by vendors under the names Salt Typhoon, FamousSparrow, Earth Estries, UNC2286, RedMike and OPERATOR PANDA, active since at least 2019. It is known for long-term intrusions into telecommunications providers (including the 2024 breaches of major US carriers), government, energy and technology organizations, for exploiting internet-facing network devices such as Cisco and Microsoft Exchange, and for the Demodex kernel-mode rootkit and SparrowDoor backdoor.
Last updated Oct 15, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.