Flax Typhoon
Flax Typhoon is classified as state-sponsored.
- Malware families
- 1
- Origin
- China
- Also known as
- 2
Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected. They exploit vulnerabilities in public-facing servers, use living-off-the-land techniques, and deploy a VPN connection to maintain persistence and move laterally within compromised networks.
The group's reported origin is China.
The group is associated with 1 malware families.
Also known as: Ethereal Panda, Storm-0919
The group is associated with 1 malware families.
Malware families
- Nosedive
Published reports on this actor:
- https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
- https://www.crowdstrike.com/global-threat-report/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.