Ethereal Panda

Ethereal Panda, also known as Flax Typhoon or RedJuliett, is a threat actor believed to be linked to the Chinese government. This group has been involved in various cyber espionage activities targeting organizations primarily in Taiwan. Reports from cybersecurity firms such as Microsoft and CrowdStrike have identified significant overlaps in the activities of these aliases, suggesting that they are indeed the same entity operating as a nation-state-linked threat group based in China. In late August, Microsoft linked Ethereal Panda (Flax Typhoon) to a widespread cyber espionage campaign against numerous Taiwanese organizations. Similarly, Insikt Group's report noted that "RedJuliett closely overlaps with public reporting under the aliases Flax Typhoon (Microsoft) and Ethereal Panda (CrowdStrike)." These findings indicate that the group utilizes sophisticated tactics, techniques, and procedures (TTPs), including the use of open-source webshell Godzilla, to carry out their malicious activities. Furthermore, in the previous month, Lumen Technologies' Black Lotus Labs detailed a botnet controlled by this Chinese espionage group. The botnet infected over 260,000 devices globally using a modified version of the Mirai internet-of-things malware, compromising routers, modems, IP cameras, NAS servers, and digital video recorders. This level of activity underscores the significant threat posed by Ethereal Panda and its associated entities, highlighting the need for robust cybersecurity measures to counter their operations.