Flax Typhoon

Flax Typhoon, also known as RedJuliett and Ethereal Panda in different cybersecurity circles, is a threat actor linked to China that has been actively targeting Taiwan. The group's activities have been closely monitored by several cybersecurity firms, including Microsoft and CrowdStrike. The use of multiple aliases for the same group is a common practice in the cybersecurity industry due to varying naming conventions. In August 2023, Microsoft reported that Flax Typhoon had exploited vulnerabilities in public-facing servers to infiltrate networks. The group deployed a VPN connection to network infrastructure controlled by the threat actors to collect credentials from compromised systems. This campaign predominantly targeted Taiwanese organizations. Flax Typhoon used the open-source client and server VPN software SoftEther to generate multiple TLS certificates to communicate with targeted networks. The Insikt Group's report indicates that RedJuliett, another alias for Flax Typhoon, intensifies Taiwanese cyber-espionage via network perimeter. The overlap between these groups suggests a coordinated effort to compromise Taiwanese digital assets. Given the persistent nature of these attacks, it's evident that Flax Typhoon represents a significant ongoing cybersecurity threat.