Flax Typhoon
Flax Typhoon is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 7 sectors, including Government and Technology, in 12 countries, including the United States and Japan. It uses 15 MITRE ATT&CK techniques.
- Ethereal Panda
- RedJuliett
- Origin
- China
- Techniques
- 15
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2021
- Last seen
- Aug 24, 2023
- Record updated
Who They Target.
About Flax Typhoon.
Flax Typhoon is a China-based nation-state activity group tracked by Microsoft and cataloged by Malpedia. Microsoft reports that it has targeted Taiwanese government, education, critical manufacturing, and information technology organizations since mid-2021, with behavior suggesting espionage intent. The actor uses China Chopper and legitimate software such as SoftEther VPN, alongside living-off-the-land techniques, to establish and retain access. China's location, nation-state classification, and espionage intent remain Microsoft vendor assessments, and Microsoft did not observe final objectives in the reviewed campaign.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.