Flax TyphoonThreat actor
- ethereal panda
- storm-0919
Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected.From MISP Galaxy
Last reported 2 days ago, by The Hacker News20 reports
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1110.003Password Spraying
“The activity involves exploiting flaws using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while setting up persistence through VPN software and exfiltrating emails and credentials using scripts.”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1110Brute Force
“…oducts (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomwa…”
- T1003.006DCSync
“To take credentials, they ran a tool named DC.exe that uses DCSync, a technique that copies data from a domain controller through Active Directory's replication service.”
- T1003OS Credential Dumping
“OS Credential Dumping: DCSync”
- T1003.001LSASS Memory
“Blindsight, a publicly available tool to dump LSASS memory with evasion techniques based on transactional NTFS”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
20 reports, newest first · the exact sentence from each-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More“VulnCheck Finds XWiki Exploits, Botnet Activity Tied to IPs in Flax Typhoon Advisory”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“FBI Disrupts Hacking Tools and Domains Linked to Flax Typhoon — The U.S.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“New Flax Typhoon seizures: US authorities have seized seven domains used for Chinese hacking operations.”
-
Week in review: FortiBleed is still active, Patch Tuesday forecast“FBI disrupts Flax Typhoon hacking tools used in global cyberattacks”
-
TP-Link Sued by Four More U.S. States Over Router Security and China Ties“The claim that Chinese state hackers used TP-Link routers in the Volt Typhoon and Flax Typhoon campaigns rests on testimony given in 2025.”
-
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies“Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies”
-
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools“Researchers have linked it to a hacking group known as Flax Typhoon, also called Ethereal Panda or RedJuliett.”
-
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group“The work of Integrity Technology Group has in the past enabled prolific Beijing-backed groups such as Flax Typhoon (aka Ethereal Panda, Red Juliett) according to the advisory, published on October 8.”
-
FBI disrupts Flax Typhoon hacking tools used in global cyberattacks“FBI disrupts Flax Typhoon hacking tools used in global cyberattacks”
-
US Disrupts Chinese State-Sponsored Hacking Tools“…ty Tech’s Raptor Train botnet, and in 2025 sanctioned it for providing cybersecurity products to Chinese state-sponsored APTs such as Flax Typhoon.”
-
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions“FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions”
-
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide“…court-authorized seizures are the latest in a long series of US law-enforcement attempts to disrupt a Beijing-backed cybercrew called Flax Typhoon and shut down its botnet.”
-
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub“The Justice Department and FBI announced that they had seized two hacking tools connected to the Chinese government-linked group Flax Typhoon and a China-based company that the U.S.”
-
International coalition seizes tools used by cyber firm behind Flax Typhoon“International coalition seizes tools used by cyber firm behind Flax Typhoon”
-
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails“The hackers' methods are "consistent with" activity that security companies track as Flax Typhoon, Ethereal Panda, and RedJuliett, among others, the advisory said.”
-
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data“Notably, the threat actors enabled by Integrity Tech use TTPs consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett, among others.”
-
TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws“To counter those claims, the states cite congressional testimony that TP-Link routers were exploited in the Volt Typhoon and Flax Typhoon campaigns.”
-
US states sue popular kitmaker TP-Link over China risks“It further cites Joyce's that TP-Link routers were among the brands exploited in the China-linked Volt Typhoon and Flax Typhoon campaigns.”
-
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting“The DoJ linked that botnet with a different Chinese state-sponsored group, Flax Typhoon.”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“…of such cooperation, where the APT group Earth Estries handed over a compromised asset to Earth Naga, another APT group also known as Flax Typhoon, RedJuliett, or Ethereal Panda.”
Indicators in its reports
named in the reports above- c0cc[.]ccin 5 reports
- 98aicai[.]comin 4 reports
- 98aicode[.]comin 4 reports
- outlook3650[.]comin 4 reports
- youtubecard[.]comin 4 reports
- linkedinns[.]netin 4 reports
- 98aiblog[.]comin 2 reports
- fbijobs[.]govin 1 report
- back-trust-aurora.cluster-ctrjumtpbmf.mnl-east-2.timcorpnet[.]comin 1 report
- afddd9d14453d4f9-1e185df7e4.ap-southeast-mnl.timcorpnet[.]comin 1 report
- 103.175.16[.]77in 1 report
- 45.92.158[.]50in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.