f2bbba1ea0f34b262f158ff31e00d39d89bbc471d04e8fca60a034cabe18e4f4

SHA-256 of `cmd1`, a Linux/Go custom SFTP client used by the Salt Typhoon / GhostEmperor cluster to stage and exfiltrate encrypted archives. Listed in Table 5 of the September 2025 joint advisory `Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System` (AA25-239A).

first seen

Aug 26, 2025

publisher

CISA / NSA / FBI