Flax Typhoon

Flax Typhoon is a threat actor reportedly linked to China that has been actively targeting Taiwan, as well as other regions globally. This group, also known by aliases such as RedJuliett and Ethereal Panda, has been implicated in cyberespionage activities against critical infrastructure entities, government organizations, and private companies. They are one of several Advanced Persistent Threats (APTs) sponsored by China, including Salt Typhoon and Volt Typhoon, which Microsoft has publicly disclosed. Flax Typhoon's activities have been observed across different sectors, including IT, military, and governmental interests around the South China Sea. A distinctive feature of Flax Typhoon's operations is its extensive use of SoftEther VPN, an open-source, cross-platform VPN software favored by many cybercriminals. The group has been observed switching from its full-featured backdoor to using the SoftEther VPN Bridge on machines of governmental organizations in the EU. Furthermore, they've deployed SoftEther VPN servers at telecommunications operators in Africa. This shift towards common VPN software aligns with tactics observed in other China-backed APTs such as Gallium and Webworm. Recently, Lumen Technologies' threat intelligence group, Black Lotus Labs, detailed a botnet linked to Flax Typhoon that used a modified version of the Mirai internet-of-things malware to compromise routers, modems, IP cameras, NAS servers, and digital video recorders. The experts believe this botnet is controlled by Flax Typhoon, further cementing the group's reputation for stealthy and persistent cyber operations. Flax Typhoon's activities pose a significant threat to global cybersecurity, highlighting the need for robust defense mechanisms against such sophisticated attacks.