Flax Typhoon
Aliases: Ethereal Panda, Storm-0919, ETHEREAL PANDA
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:12:05
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:tw
Context
Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected. They exploit vulnerabilities in public-facing servers, use living-off-the-land techniques, and deploy a VPN connection to maintain persistence and move laterally within compromised networks.
Reports & references
- Microsoft — Flax Typhoon Using Legitimate Software To Quietly Access Taiwanese Organizations (report)
- CrowdStrike — Global Threat Report (report)
- raw.githubusercontent.com — Microsoftmapping (report)