Flax Typhoon

Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected. They exploit vulnerabilities in public-facing servers, use living-off-the-land techniques, and deploy a VPN connection to maintain persistence and move laterally within compromised networks.

Grubun kökeni Çin olarak bildiriliyor.

Grup 1 zararlı yazılım ailesiyle ilişkilendirildi.

Diğer adları: Ethereal Panda, Storm-0919

Grup 1 zararlı yazılım ailesiyle ilişkilendirildi.

Bu aktör hakkında yayımlanmış raporlar:

• https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
• https://www.crowdstrike.com/global-threat-report/

Kaynak: MISP Galaxy, Malpedia.