Also known as: Ethereal Panda, Storm-0919
Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected. They exploit vulnerabilities in public-facing servers, use living-off-the-land techniques, and deploy a VPN connection to maintain persistence and move laterally within compromised networks.
Executive Summary
Flax Typhoon is a suspected Chinese state-sponsored threat actor primarily targeting organizations in Taiwan through espionage campaigns. The group focuses on long-term network access using minimal malware and operates discreetly by leveraging built-in OS tools and legitimate software.
Goals & Targeting
Flax Typhoon's primary goal appears to be espionage, targeting sectors in Taiwan likely related to government, military, or business. Their targeting of public-facing servers suggests a focus on gaining access to sensitive information while remaining undetected.
Enhanced Description
Flax Typhoon, also known as Ethereal Panda or Storm-0919, is a Chinese state-sponsored actor targeting mainly Taiwanese organizations for espionage. They employ sophisticated techniques such as exploiting server vulnerabilities and using living-off-the-land methods to maintain persistence. Their use of VPNs for C2 communication underscores their focus on stealth and long-term access. Despite being first identified in 2016 or later, they remain active with no known end.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
Flax Typhoon is active with noted campaigns in Taiwan, focusing on long-term access. Their operations include OS tool abuses and VPN usage, likely maintaining persistence across multiple targets.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
High confidence in their state sponsorship and targeting focus, but details on tools and campaigns are inferred.
No techniques linked yet.
No tools linked yet.
No campaigns linked yet.
No observed data linked yet.
No IOCs linked yet.
No references recorded yet.
0
Techniques
0
Tools
0
Campaigns
0
IOCs
0
Observed Data
0
Tactics