Flax Typhoon Espionage Infrastructure Tied to Taiwanese Targets and Possible University Links

Microsoft said the China-backed espionage group Flax Typhoon has quietly compromised organizations in Taiwan by abusing legitimate tools and living-off-the-land techniques, with targeting focused on government, education, critical manufacturing, and information technology. The activity relied on access through public-facing applications, persistence with software such as SoftEther VPN, and proxying through compromised SOHO devices to reduce detection, aligning the campaign with broader PRC cyber operations described in U.S. defense strategy documents.

SecurityScorecard later reported additional infrastructure likely linked to Flax Typhoon by tracing reused TLS certificate SHA-1 fingerprints associated with the group’s SoftEther VPN servers and analyzing partner NetFlow data. Its researchers identified repeated communication between a previously flagged VPN IP, 45.204.1[.]203, and four IP addresses attributed to Fudan University — 202.120.224[.]129, 202.120.224[.]82, 202.120.224[.]114, and 202.120.224[.]116 — raising the possibility of higher-education-linked support infrastructure while noting the university systems could themselves be compromised; the firm urged likely targets to monitor and consider blocking the identified infrastructure.