Uptime Hamster: 113d 12h 34mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
Logo del actor de amenaza Flax Typhoon

Flax Typhoon

0 incidentes 0 paises 0 sectores apt CN Ultimo: -
Aliases: Ethereal Panda, Storm-0919, APT FLAXTYPHOON
Ver en IntelTracker → APTTrail →
Flax Typhoon, also known by the aliases Ethereal Panda and Storm-0919, is a state-sponsored cyber espionage group assessed with high confidence to be of Chinese origin. The group has been active since mid-2021, focusing on intelligence gathering and maintaining long-term access within targeted networks. Their primary motivation is cyber espionage, aiming to establish and sustain persistent access to facilitate intelligence collection rather than disruptive or financially motivated attacks. What uniquely sets Flax Typhoon apart is their heavy reliance on living-off-the-land (LOLBins) techniques and legitimate software, along with minimal use of custom malware, which enables them to maintain stealth and persistence within compromised environments for extended periods. The group is also known as Red Juliet and UNC5007 by other security vendors.

Aliases del actor

Ethereal PandaStorm-0919APT FLAXTYPHOON

Actores similares

apt-flaxtyphoonactor · 1ethereal-pandaactor · 1apt-sharppandaactor · 1apt-twistedpandaactor · 1APT27 (Emissary Panda)actor · 1Stone Pandaapt · 0Vicious Pandaapt · 0Pitty Pandaapt · 0Hurricane Pandaapt · 0Pirate Pandaapt · 0

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

TipoEstadoHost / enlaceTitle / ultimo titulo
DLS / leak siteunknownotx.alienvault.comAPT FLAXTYPHOON indicators and references
DLS / leak siteunknownwww.microsoft.comAPT FLAXTYPHOON indicators and references
DLS / leak siteunknownwww.virustotal.comAPT FLAXTYPHOON indicators and references
X/Twitterunknownx.comAPT FLAXTYPHOON indicators and references
X/Twitterunknownx.comAPT FLAXTYPHOON indicators and references
Repositoriounknowngithub.comAPT FLAXTYPHOON indicators and references
DLS / leak siteunknownraw.githubusercontent.comAPT FLAXTYPHOON indicators and references
X/Twitterunknown149.28.137.179APTTrailURLhttpAPT FLAXTYPHOON indicators and references
Motivacion
Information theft and espionage
Malware asociado
elf.nosedive
Tecnicas MITRE
T1090 - Proxy, T1068 - Exploitation for Privilege Escalation, T1190 - Exploit Public-Facing Application, T1133 - External Remote Services, T1505 - Server Software Component, T1059.001 - PowerShell
CVEs relacionadas
CVE-2025-53771, CVE-2025-53770, CVE-2025-1316, CVE-2025-0282, CVE-2025-0001, CVE-2024-4947
Tipo
apt
Pais origen
CN
Motivacion
Information theft and espionage
Impacto
75
Actualizado
Sat, 27 Ja

Paises objetivo (OSINT)

DjiboutiHong KongKenyaKorea, Republic ofMalaysiaPhilippinesRwandaTaiwan, Province of ChinaUnited States

Sectores objetivo (OSINT)

ManufacturingEducational ServicesPublic AdministrationEnergy & Utilities Information ServicesFinanceHealthCare & Social AssistanceOil & GasOther Information ServicesNational Security&International Affairs