Flax Typhoon

Flax Typhoon is a China-linked, China-based nation-state threat actor, also referred to as Ethereal Panda and Microsoft cluster Storm-0919. Microsoft described the group as active since mid-2021. U.S. officials and the FBI have stated that Flax Typhoon operated at the direction of the Chinese government, and the FBI assessed that Beijing-based Integrity Technology Group was responsible for intrusion activity attributed to Flax Typhoon. Court documents and government reporting described Integrity Technology Group as a publicly traded Beijing company and PRC government contractor that developed and controlled botnet infrastructure used by the group. The group has primarily targeted government agencies, education, critical manufacturing, and information technology organizations in Taiwan, and has also successfully attacked multiple U.S. and foreign corporations, universities, government agencies, telecommunications providers, media organizations, and critical infrastructure providers. Reporting also links Flax Typhoon to broader targeting of U.S. interests and to activity against critical infrastructure sectors including communications, energy, transportation, and water. Taiwan’s NSB named Flax Typhoon among Chinese groups involved in sustained targeting of Taiwan’s critical sectors, including energy, healthcare, communications, government, and technology. Flax Typhoon has used covert networks of compromised infrastructure to conduct cyber espionage and to disguise malicious activity. Multiple government advisories state that China-nexus actors including Flax Typhoon use large-scale covert networks built from compromised SOHO routers, IoT devices, IP cameras, DVRs, firewalls, and NAS devices across the cyber kill chain for reconnaissance, malware delivery, command and control, and data exfiltration. The group has been linked to the Raptor Train botnet, which Black Lotus Labs assessed with medium to high confidence was operated by Flax Typhoon. U.S. law enforcement disrupted a Flax Typhoon-linked botnet of more than 200,000 consumer devices; separate reporting states the Mirai-variant botnet had exploited more than 260,000 IoT devices globally. The botnet was used to disguise malicious cyber activity as routine internet traffic from infected devices. During the FBI disruption, Flax Typhoon attempted to migrate infected devices and launched a DDoS attack against FBI operational infrastructure. Observed tradecraft includes use of legitimate SoftEther VPN software to obfuscate activity, maintain persistence, and evade detection; protocol tunneling and abuse of external remote services; and maintenance of long-term access, including reporting that the group maintained year-long access by turning an ArcGIS SOE into a web shell backdoor. Reporting also links Flax Typhoon-associated botnet activity to exploitation of vulnerabilities in routers, IP cameras, and NAS devices, with activity including DDoS attacks and data theft.