Flax Typhoon
flax-typhoon · primary source: Microsoft · first observed 2021
CN · ChinaState-sponsoredHigh confidencelast cited Sep 17, 2024 · 1.7y ago
PRC state-affiliated intrusion set operating through Integrity Technology Group — a Beijing-based, publicly-traded cybersecurity contractor sanctioned by the U.S. Treasury OFAC in January 2025. Specialized in compromising internet-facing IoT devices (routers, IP cameras, NVRs, storage devices) to build a residential-IP proxy botnet. The FBI disrupted a 260,000-device botnet attributed to the group on 18 September 2024, freeing devices spread across the United States, Vietnam, Germany, and other countries.
Aliases
Ethereal PandaCrowdStrikeRedJuliettOther
Motivations
espionageinfrastructure
Target sectors
governmentacademiamediatelecommunicationsmanufacturing
Target countries
USVNDEROZAFRGB
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
1 eventIndicators of compromise
3 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| Name | SoftEther VPN bridge binary renamed by Flax Typhoon to `conhost.exe` or `dllhost.exe` to masquerade as Windows system components. Microsoft's August 2023 advisory describes this as the actor's signature persistence mechanism, used to tunnel SoftEther over HTTPS to TCP/443. | Aug 23, 2023 | Microsoft Threat Intelligence |
| SHA-1 | SHA-1 fingerprint of a TLS certificate observed on Flax Typhoon SoftEther VPN bridge infrastructure, published in the August 2023 Microsoft Threat Intelligence disclosure `Flax Typhoon using legitimate software to quietly access Taiwanese organizations`. | Aug 23, 2023 | Microsoft Threat Intelligence |
| Domain | Tier-2 C2 root domain for the `Oriole` campaign of the Raptor Train IoT botnet operated by Flax Typhoon - linked by DOJ/FBI to Beijing-based Integrity Technology Group. Active June 2023 through the FBI takedown announced September 2024; documented by Lumen Black Lotus Labs. | May 31, 2023 | Lumen Black Lotus Labs |
Related actors
shared ATT&CK techniques- CN · ChinaAPT33 shared techniques
- KP · DPRKAndariel2 shared techniques
- RU · RussiaDragonfly2 shared techniques
- CN · ChinaGTG-10022 shared techniques
- IR · IranPioneer Kitten2 shared techniques
- CN · ChinaPLA Unit 544662 shared techniques
References
cite this page
Threat Intel Tracker. (2026-05-19). Flax Typhoon — actor profile. Retrieved from https://threatintel.local/actors/flax-typhoon
latest cited activity · 2024-09-18 · 3 cataloged indicators