Silent Push links 45 domains to Salt Typhoon & UNC4841

Key takeaways:

• Domains registered between 2020–2025, using fake WHOIS personas.
• Overlaps with UNC4841, notorious for exploiting Barracuda appliances.
• Connections to Demodex, Snappybee, and Ghostspider malware.
• Possible psychological ops with domains like “newhkdaily[.]com.”

Silent Push’s Zach Edwards emphasized repeated patterns in domain registration that defenders could have leveraged sooner.

⚠️ Salt Typhoon (a.k.a. GhostEmperor, FamousSparrow) has a track record of infiltrating U.S. National Guard networks and targeting global telcos.

What do you think: Are WHOIS enrichment + log correlation underused defenses in APT detection? Or are these tactics too noisy against advanced actors? Let’s discuss.