ChinaAttributedChinese government-linkedEspionageActive 2021 – 2026Flax Typhoon
Also known asEthereal Panda · Storm-0919 · BRONZE FLAXEN
Summary
Taiwan-focused PRC actor operated through Integrity Technology Group, a Beijing company that DOJ says is 'known to the private sector as Flax Typhoon' and that the US Treasury sanctioned in Jan 2025 (also Ethereal Panda, RedJuliett). It built the Raptor Train Mirai-based botnet of >200,000 SOHO/IoT devices, disrupted by the FBI in Sep 2024. On 8 Oct 2026 DOJ/FBI seized its Microscan scanner (used against a South Carolina power company, Japanese and Polish airports and Taiwanese gas/power firms) and FishHub spear-phishing tool (~20 Taiwanese universities compromised), and ten agencies published AA26-281A on Integrity Tech-enabled exploitation, XSS and Exchange password spraying since 2021. Tradecraft: minimal malware, living off the land, VPN software (SoftEther) for persistence, and a 2024–2025 ArcGIS server-object-extension web shell (ReliaQuest, assessed).
Attribution
No service publicly named
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- FBI, CISA, NSA and partners (AA26-281A) (Government, 2026-10-08)
Enabled by Integrity Tech, a China-based company with links to the Chinese government - US Department of Justice (Government, 2024-09-18)
Court-authorised disruption of a botnet used by PRC state-sponsored hackers
Campaigns 6
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Taiwanese chemicals company — outdated public-facing application, SoftEther VPN | 2026-06 | Taiwan | Chemical, Semiconductors | ESET Research (2026-10-28) — products used in semiconductor manufacturing |
| Taiwan critical-infrastructure targeting (NSB 2025 annual assessment) | 2025 | Taiwan | Energy, Healthcare, Communications, Government, Technology | Taiwan National Security Bureau, 'Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025' (2026-01-04) |
| ArcGIS SOE web-shell backdoor (year-long access)ASSESSED | 2024 – 2025 | Undisclosed (critical-infrastructure-aligned) | Geospatial / GIS infrastructure | ReliaQuest (2025-10-14) |
| Integrity Tech-enabled exploitation, XSS and Exchange password spraying (AA26-281A)ASSESSED | 2021-01 – 2026-10 | USA, Global | Critical Infrastructure, Government, Education | FBI/CISA/NSA + partners AA26-281A (2026-10-08) |
| Raptor Train IoT/SOHO botnet (>200,000 devices) — disrupted by FBI | 2021 – 2024-09 | USA, Global | Critical Infrastructure, Government, Telecommunications | US DOJ (2024-09-18) |
| Microscan scanning and FishHub spear-phishing tools — seized by DOJ/FBI | 2017 – 2026-10 | USA, Taiwan, Japan, Poland | Energy, Aviation, Education, Critical Infrastructure | US DOJ (2026-10-08) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access1 | T1190Exploit Public-Facing Application |
|---|---|
| Execution1 | T1059.003Windows Command Shell |
| Persistence2 | T1078Valid AccountsT1505.003Web Shell |
| Privilege Escalation1 | T1546.008Accessibility Features |
| Stealth1 | T1036Masquerading |
| Command and Control1 | T1572Protocol Tunneling |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| SoftEther VPN | Tunnel (legitimate abuse) | Windows/Linux |
| China Chopper | Web shell | Windows |
| Microscan | Python web application with 1,300+ vulnerability-scanning scripts (Integrity Tech) | Web |
| FishHub | Spear-phishing and malware-delivery tool (Integrity Tech) | Web |
Exploited vulnerabilities 2
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-28799 | 10 | QNAP NAS RCE (KEV 2022-03-31) |
| CVE-2022-30525 | 9.8 | Zyxel Firewall OS Command Injection (KEV 2022-05-16) |
Highest CVSS first.
Infrastructure patterns
- Raptor Train: Mirai-based botnet of 200,000+ devices run by Integrity Technology Group; disrupted Sep 2024 (DOJ, 2024)
- SoftEther VPN bridges on compromised hosts link to its infrastructure over TCP 443 (Microsoft, 2023)
Reporting and advisories 7
- Taiwan National Security Bureau
Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025 (4 Jan 2026) - ReliaQuest
ArcGIS SOE web-shell backdoor (year-long access) - US DOJ
Raptor Train IoT/SOHO botnet (>200,000 devices) — disrupted by FBI - US DOJ
Microscan scanning and FishHub spear-phishing tools — seized by DOJ/FBI - FBI/CISA/NSA + partners AA26-281A
Integrity Tech-enabled exploitation, XSS and Exchange password spraying (AA26-281A) - Microsoft Threat Intelligence
Flax Typhoon using legitimate software to quietly access Taiwanese organizations (Aug 2023) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)