Ethereal Panda

Ethereal Panda, also known as Flax Typhoon, is a threat actor believed to be based in China. The activities of this group strongly overlap with those reported under the aliases Flax Typhoon by Microsoft and Ethereal Panda by CrowdStrike. This correlation suggests that Ethereal Panda operates as a nation-state-linked threat group, indicating its potential ties to the Chinese government. According to CrowdStrike's reports, Ethereal Panda has been active since at least 2021, utilizing similar tactics, techniques, and procedures (TTPs) including the use of the open-source webshell Godzilla. In late August, Microsoft linked the Chinese Advanced Persistent Threat (APT) group Flax Typhoon, aka Ethereal Panda, to a cyber espionage campaign targeting numerous organizations in Taiwan. This campaign was part of an overall increase in attacks within Asia, highlighting the geopolitical motivations behind these actions. RedJuliett, another alias for this threat actor, also shows significant overlap with public reporting on Flax Typhoon and Ethereal Panda, further solidifying their connection. The threat posed by Ethereal Panda is significant due to its suspected nation-state backing and its focus on high-profile targets such as Taiwanese organizations. Its use of sophisticated TTPs and tools like the Godzilla webshell indicates a high level of technical capability. As cybersecurity industry continues to track and report on Ethereal Panda's activities, it's crucial for organizations, particularly those in Asia, to remain vigilant and proactive in their cyber defense strategies.