Flax Typhoon

Flax Typhoon, a threat actor linked to China, has been identified as the perpetrator behind a series of cyber attacks targeting Taiwan. The group is known for its unique approach, utilizing minimal malware and custom payloads, but heavily relying on legitimate applications instead. This tactic allows them to infiltrate systems with less detection risk, making their operations stealthy and effective. The tactics, techniques, and procedures (TTPs) employed by Flax Typhoon are consistent with those used in previous attacks attributed to this group. Notably, Microsoft reported that Flax Typhoon used the open-source client and server VPN software SoftEther to generate multiple TLS certificates. This enabled the group to establish encrypted communication channels with targeted networks, further enhancing their ability to conduct covert operations. In addition, it's worth noting that there's an overlap between Flax Typhoon and another alias, RedJuliett, as well as Ethereal Panda. This suggests that these entities could be different operational facets of the same overarching group or closely associated groups. Understanding these connections can provide valuable insights into the broader strategies and objectives of these threat actors.