Flax Typhoon

Also known as: Ethereal Panda, RedJuliett

Overview

Chinese state-sponsored group operating a massive IoT botnet of compromised routers and cameras for espionage proxy networks. Targets Taiwan, Southeast Asia, and US entities.

MITRE ATT&CK Coverage

Recon
Res Dev
Init Access
Execution
Persistence
Priv Esc
Def Evasion
Cred Access
Discovery
Lat Move
Collection
C2
Exfil
Impact
3 of 14 tactics observed

Raw TTPs

IoT Botnet OperationsVPN ExploitationWeb Shell DeploymentProxy NetworksSOHO Device Exploitation

Related Intelligence (7)

LOWVulnerability

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow

CVE-2015-3306
The Hacker News
CRITICALVulnerability

FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions

The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical infrastructure. The list of seized

The Hacker News
CRITICALMalware

FBI Seizes Domains Used in Flax Typhoon Attacks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fbi-seizes-domains-used-in-flax-typhoon-attacks-image_small-10-a-33049.jpg" align=right hspace=4><b>US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft</b><br>The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advis

Bank Info Security
CRITICALApt

FBI disrupts Chinese hacking tools used to breach critical infrastructure

The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]

BleepingComputer
CRITICALMalware

DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub

The seizures of the tools, allegedly operated by the Chinese firm Integrity Tech, accompanied a warning from the FBI, CISA and NSA. The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop .

CyberScoop
LOWMalware

International coalition seizes tools used by cyber firm behind Flax Typhoon

The U.S. and other nations took down digital tools and infrastructure by Beijing-based Integrity Tech that allowed "widespread vulnerability scanning and, in some cases, intrusions" as part of the Flax Typhoon campaign.

The Record
CRITICALRansomware

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

<div class="OutlineElement Ltr SCXW40950166 BCX8"> <h2><strong>Advisory at a Glance&nbsp;</strong></h2> <table dir="ltr"> <tbody> <tr> <th> <div class="TableCellContent SCXW40950166 BCX8"> <div class="OutlineElement Ltr SCXW40950166 BCX8"> <p><strong>Title&nbsp;</strong></p> </div> </div> </th> <td> <div class="TableCellContent SCXW40950166 BCX8"> <div class="OutlineElement Ltr SCXW40950166 BCX8">

CVE-2014-6278CVE-2015-3306
CISA Advisories