Loading story…
Microsoft said the China-backed espionage group Flax Typhoon has quietly compromised organizations in Taiwan by abusing legitimate tools and living-off-the-land techniques, with targeting focused on government, education, critical manufacturing, and information technology. The activity relied on access through public-facing applications, persistence with software such as SoftEther VPN, and proxying through compromised SOHO devices to reduce detection, aligning the campaign with broader PRC cyber operations described in U.S. defense strategy documents.
SecurityScorecard later reported additional infrastructure likely linked to Flax Typhoon by tracing reused TLS certificate SHA-1 fingerprints associated with the group’s SoftEther VPN servers and analyzing partner NetFlow data. Its researchers identified repeated communication between a previously flagged VPN IP, 45.204.1[.]203, and four IP addresses attributed to Fudan University — 202.120.224[.]129, 202.120.224[.]82, 202.120.224[.]114, and 202.120.224[.]116 — raising the possibility of higher-education-linked support infrastructure while noting the university systems could themselves be compromised; the firm urged likely targets to monitor and consider blocking the identified infrastructure.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
On August 24, Microsoft published an analysis of a newly tracked threat actor it calls Flax Typhoon, assessing that it conducts espionage on behalf of the People's Republic of China. Microsoft said the group mainly targeted Taiwanese organizations in government, education, critical manufacturing, and information technology.
The U.S. Department of Defense's 2023 Cyber Strategy described the People's Republic of China as a broad and pervasive cyber espionage threat to the United States and its allies and partners. The strategy also said state control over China's cybersecurity industry and large technology workforce contribute to PRC cyber capabilities.
SecurityScorecard reported that the China-linked espionage group Flax Typhoon has operated since 2021. The group primarily targeted organizations in Taiwan and also appeared in Southeast Asia, North America, and Africa.
SecurityScorecard's STRIKE Team observed repeated communication between Flax Typhoon-linked VPN IP 45.204.1[.]203 and four Chinese IP addresses attributed to Fudan University. The researchers assessed this traffic may indicate a possible link between Flax Typhoon and Fudan University, while noting the university-attributed IPs could also have been compromised.
SecurityScorecard reported additional infrastructure likely used by Flax Typhoon by matching TLS certificate SHA-1 fingerprints from Microsoft's reporting to other SoftEther VPN servers. It identified several likely linked IP addresses, including 92.253.235[.]9, 45.204.1[.]203, 45.195.149[.]164, 182.61.132[.]155, and 103.51.145[.]76.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcesecurityscorecard.com
Open sourcemicrosoft.com
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and private-sector researchers said the China-linked threat actor **Flax Typhoon** operated a sprawling IoT botnet known as **Raptor Train** to conceal intrusions into critical infrastructure networks. Black Lotus Labs said the botnet had been active since 2020, at one point exceeding 60,000 live nodes and compromising more than 200,000 routers, NAS devices, IP cameras, and other internet-exposed systems. The operation used a multi-tier architecture and a custom Mirai-derived implant called `Nosedive`, which enabled remote command execution, file transfer, and retained **DDoS** capability while using in-memory execution and anti-forensics techniques. Researchers linked the activity to targeting in the United States and Taiwan across government, military, telecommunications, higher education, defense industrial base, and IT sectors, alongside scanning and likely exploitation attempts against **Atlassian Confluence** and **Ivanti Connect Secure** appliances. The **FBI** and Department of Justice said they disrupted the botnet in a court-authorized operation that removed malware from infected routers, and officials later said the action effectively dismantled infrastructure used by Chinese operators to hide follow-on hacking. Subsequent reporting said the botnet exploited dozens of vulnerabilities across edge and IoT products, with VulnCheck identifying **66 actively targeted CVEs** tied to the campaign, far more than were listed in CISA’s Known Exploited Vulnerabilities catalog. Additional reporting also pointed to corporate links around **Integrity Technology**, described as connected to Flax Typhoon and tied through competitive, partner, and client relationships to **i-SOON**, adding to the picture of a broader Chinese intrusion ecosystem supporting espionage and potential disruptive operations.
Jun 29, 2026
Microsoft and U.S. officials said China-linked threat groups **Volt Typhoon** and **Flax Typhoon** used living-off-the-land techniques and legitimate software to quietly compromise targets while minimizing detection. Volt Typhoon was tied to intrusions affecting U.S. critical infrastructure, with reporting describing the group as breaching networks through stealthy post-compromise activity rather than malware-heavy tradecraft. U.S. agencies later warned that the campaign appeared aimed at **pre-positioning** inside critical infrastructure for potential disruptive or destructive operations. Microsoft separately reported that **Flax Typhoon** targeted organizations in Taiwan for cyber-espionage, relying on valid credentials, remote access tools, and other trusted utilities to maintain persistence and blend into normal network activity. Subsequent reporting and later tracking indicated that Volt Typhoon remained active against U.S. infrastructure, reinforcing concerns that Chinese state-linked operators are sustaining long-term access across strategically important environments while using native tools and legitimate software to evade defenders.
Jun 29, 2026
Trend Micro and TrendAI reported that China-aligned espionage groups collaborated by passing live access to already-compromised networks between intrusion sets, a model Trend calls **"Premier Pass-as-a-Service."** In one cited case, **Earth Estries** breached a Southeast Asian government environment, deployed **CrowDoor** and related tooling, and then enabled follow-on activity tied to **Earth Naga**—also tracked as **Flax Typhoon**, **RedJuliett**, or **Ethereal Panda**—including **ShadowPad** infrastructure. The reporting says this approach differs from traditional initial access brokerage because downstream operators appear to receive direct access to victim assets rather than just stolen credentials or footholds. The activity aligns with separate reporting that **RedJuliett** intensified cyber espionage against Taiwanese organizations through exploitation of internet-facing network perimeter devices, while Trend Micro described **Earth Estries** as conducting long-term intrusions across government, telecommunications, and information service providers in APAC, Taiwan, and NATO countries. Researchers said the cooperative model can place multiple China-linked actors in the same intrusion chain or even the same process flow, complicating attribution and incident response, and they highlighted exploitation of **Citrix** devices including `CVE-2025-5777` among the techniques used to gain or extend access.
Aug 21, 2026