Loading threat actor…
Flax Typhoon is a China-based, Chinese government-linked cyberespionage actor also tracked as Ethereal Panda and Storm-0919. Its activity overlaps with operations tracked as Red Juliett. The group is associated with Integrity Technology Group, a Beijing-based government contractor that develops offensive tools, maintains attack infrastructure, and supports network intrusions and sensitive-data theft. Targets include organizations in Taiwan, the United States, Japan, and Poland, spanning government, education, healthcare, information technology, manufacturing, energy, utilities, transportation, and nongovernmental institutions. Flax Typhoon-associated operations combine automated reconnaissance, exploitation of known vulnerabilities in internet-facing systems, credential attacks, and hands-on intrusion activity. Associated tooling includes MicroScan, a vulnerability-scanning platform containing more than 1,300 testing scripts, and FishHub, a spear-phishing platform supporting malware delivery, remote access, and file theft. Operators use cross-site scripting to harvest credentials and EBurst for password spraying and guessing against Microsoft email services. They favor legitimate administrative tools and living-off-the-land techniques, including SoftEther VPN installations configured for persistent remote access and disguised to resemble normal Windows activity. Collection techniques include DCSync credential theft, Exchange mailbox extraction, and automated Microsoft 365 email collection and exfiltration. The group has been linked to Raptor Train, an Integrity Technology Group-operated botnet of compromised routers and other internet-connected devices that supported reconnaissance and concealed attack infrastructure. US authorities disrupted the botnet in September 2024. In October 2026, authorities seized seven domains supporting MicroScan and FishHub operations. Integrity Technology Group enables multiple operational clusters, so its broader activity should not be treated as exclusively attributable to Flax Typhoon.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
21 malware families attributed to this actor across reporting.
16 additional families tracked in Mallory.
13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.
The advisory comparison table lists CVE-2015-5477 in ISC BIND, associates it with Ethereal Panda, and dates exploitation evidence to August 2, 2015.
The advisory comparison table lists CVE-2021-3199 in ONLYOFFICE with Ethereal Panda and an exploitation first-seen date of October 8, 2026.
The advisory comparison table lists CVE-2014-6278 in GNU Bash, associates it with Ethereal Panda, and records one botnet association.
The advisory comparison table lists CVE-2015-3306 in ProFTPD with Ethereal Panda and an exploitation first-seen date of October 8, 2026.
The advisory comparison table lists CVE-2016-3081 in Apache Struts with Ethereal Panda and exploitation evidence first seen on July 23, 2026.
8 more CVEs tied to this actor tracked in Mallory.
40 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with information-gathering intrusions targeting government entities, critical infrastructure, healthcare organizations, and other sectors. The reference identifies tactical overlap with Integrity Tech-enabled operations, but cautions that these tracking classifications do not necessarily encompass all observed activity; individual campaign tools and vulnerabilities therefore cannot be confidently assigned to this group from this reference alone.
Identified in connection with enabling Chinese government-linked cyber activity. Research into the associated advisory found that several listed IP indicators remained active beyond their last-seen dates and were repurposed against newer vulnerabilities. The excerpt does not establish which observed attacks were directly attributable to Flax Typhoon.
Named as overlapping with China-linked, Integrity Tech-enabled activity targeting sensitive information. The described activity combines vulnerability exploitation and credential theft with legitimate VPN software for persistence. Individual techniques are not separately attributed to Ethereal Panda.
China-linked cyber operations enabled by Integrity Technology Group compromised organizations worldwide, including U.S. critical infrastructure. The reported activity involved vulnerability reconnaissance, credential theft, persistent VPN access, Active Directory replication abuse, and sustained email collection and exfiltration. Victims were also located across Southeast Asia, Africa, and North America.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.