Flax Typhoon FBI Takedown: 5 CVEs with CISA Patch Deadline Today

Flax Typhoon is a nation-state cyber espionage actor assessed by the FBI and CISA with high confidence to be operated by Integrity Technology Group, a Beijing-based cybersecurity company. The firm publicly advertises MicroScan as a commercial vulnerability assessment tool and FishHub as a threat intelligence platform for enterprise customers in China. The October 8 advisory and court filings expose that both platforms were used to compromise critical infrastructure targets across seven countries in a sustained espionage campaign.

The group is also tracked as Ethereal Panda and Red Juliett by other threat intelligence vendors. Microsoft's Threat Intelligence Center first publicly attributed Flax Typhoon activity in August 2023, tying the group to a Taiwan-focused espionage campaign that used living-off-the-land techniques on public-facing servers. The October 2026 action is the first formal multi-country attribution and the first seizure of Integrity Tech's operational infrastructure.

Integrity Technology Group's direct connection to Chinese government intelligence objectives mirrors the model exposed by the i-SOON leaks in 2025, where contractors fulfilled PRC tasking through commercial platforms. Flax Typhoon-linked infrastructure shares partial overlap with i-SOON operations, suggesting the two firms draw from a shared contractor ecosystem under PRC intelligence direction.

The advisory confirms that Flax Typhoon targeted a South Carolina electric power utility, multiple government offices and police agencies in Southeast Asia, health systems, and religious institutions. Victim organizations commonly reported email access loss, with actors harvesting mailboxes through the EBurst password-spraying tool against Microsoft Exchange servers.

Flax Typhoon's attack chain begins with automated reconnaissance via MicroScan, a proprietary vulnerability scanner that Integrity Technology Group operated across the public internet. MicroScan identified exposed services running the five CISA KEV CVEs, prioritizing internet-facing servers in government and critical infrastructure sectors for hands-on exploitation.

The five CISA KEV CVEs and their exploitation mechanisms:

CVE-2015-3306 (ProFTPD, CVSS 10.0): An improper access control flaw in ProFTPD 1.3.5 allows unauthenticated remote attackers to read or write arbitrary files via the SITE CPFR and SITE CPTO FTP commands. Flax Typhoon uses this to exfiltrate configuration files containing database credentials and SSH keys.

CVE-2021-3199 (ONLYOFFICE Docs, CVSS 9.8): A path traversal vulnerability in ONLYOFFICE Docs when JWT authentication is enabled allows attackers to access arbitrary files outside the document server root, exposing source code and application secrets.

CVE-2016-3081 (Apache Struts, CVSS 8.1): A command injection vulnerability via Dynamic Method Invocation in Apache Struts 2.x allows remote code execution when DMI is enabled via a specially crafted "method:" prefix in the request URL. The FBI advisory confirms active exploitation against legacy enterprise web applications.

CVE-2023-22894 (Strapi, CVSS 7.2): Strapi stores sensitive user information in cleartext, allowing an attacker with admin panel access to retrieve private user details, API tokens, and password hashes via crafted query filter parameters.

CVE-2015-5477 (ISC BIND, CVSS 7.5): A reachable assertion flaw in BIND 9.x allows remote attackers to cause a denial of service via specially crafted TKEY queries, disrupting DNS resolution for targeted networks.

For guidance on how Integrity Technology Group pivoted from initial access to mailbox theft, see the related FortiBleed advisory coverage on credential-harvesting campaigns for comparison with the credential-reuse tactics common to both operations.

The joint advisory AA26-281A documents Flax Typhoon's end-to-end tradecraft, grounded in MITRE ATT&CK techniques confirmed across multiple victim investigations. The group's operational pattern emphasizes automation, living-off-the-land binaries, and long-term stealth over rapid ransomware deployment.

Reconnaissance (TA0043): T1595.002 - Active Scanning: Vulnerability Scanning. MicroScan systematically identified internet-facing ProFTPD, ONLYOFFICE, Strapi, Apache Struts, and BIND instances, prioritizing targets in government and critical infrastructure sectors.

Resource Development (TA0042): T1583.003 - Acquire Infrastructure: Virtual Private Server. Integrity Tech operated a global network of VPS nodes to relay attack traffic and obscure operator origin. T1584.001 - Compromise Infrastructure: Botnet (Raptor Train). 200,000+ compromised IoT devices were weaponized as relay nodes and scanning platforms.

Initial Access (TA0001): T1190 - Exploit Public-Facing Application. Active exploitation of the five CISA KEV CVEs on internet-accessible servers. T1566 - Phishing. FishHub delivered targeted spearphishing emails to identified targets to harvest credentials and OAuth tokens.

Execution (TA0002): T1059 - Command and Scripting Interpreter. Post-exploitation shell access via China Chopper webshell and custom Python scripts.

Persistence (TA0003): T1133 - External Remote Services. SoftEther VPN installed on compromised hosts to maintain persistent encrypted tunnels into victim networks. T1505.003 - Server Software Component: Web Shell. China Chopper web shell deployed on compromised servers for hands-on keyboard access.

Credential Access (TA0006): T1078 - Valid Accounts. EBurst tool used for password spraying against Microsoft Exchange servers using harvested credential dumps. T1003 - OS Credential Dumping. Mimikatz deployed post-exploitation to extract domain credentials from LSASS memory.

Collection (TA0009): T1114.002 - Email Collection: Remote Email Collection. FishHub and EBurst together enabled bulk mailbox harvesting from compromised Exchange environments, confirmed against government and police agency victims in Southeast Asia.

Flax Typhoon's confirmed attack chain follows six stages, each building on the previous to achieve long-term persistent access and email exfiltration.

These two rules target SoftEther VPN installation (Flax Typhoon's primary persistence mechanism) and Exchange password spraying consistent with EBurst tool activity. Both carry experimental status; validate against your environment log format before enabling automatic blocking.

The joint advisory AA26-281A identifies Flax Typhoon's confirmed victim sectors across the United States and allied nations. Critical infrastructure organizations represent the primary targeting priority, with a secondary focus on institutions that hold sensitive personal and governmental data.

Confirmed targeted sectors include U.S. government agencies at federal, state, and local levels; critical manufacturing operations; healthcare systems and hospital networks; information technology and managed service providers; law enforcement agencies; educational institutions and universities; and religious organizations. In Southeast Asia, the group specifically targeted government offices, police agencies, and health ministries. The South Carolina electric power utility cited in DOJ filings represents the first publicly confirmed critical infrastructure intrusion in the energy sector.

Geographically, Flax Typhoon's operations concentrate on the United States as the primary target, with Taiwan representing a secondary focus given historical PRC intelligence priorities. The group has documented victims in Southeast Asia (including Vietnam, Malaysia, Thailand, and the Philippines), Africa, and North America beyond the United States.

The CISA advisory notes that Flax Typhoon specifically targets organizations that run legacy, unpatched software -- the five KEV CVEs date from 2015 to 2023. Organizations most at risk today are those with internet-facing ProFTPD FTP servers (common in academic, legacy government, and open-source project hosting environments), ONLYOFFICE Docs deployments (healthcare and public sector), Apache Struts 2.x enterprise applications (financial services and government), Strapi CMS backends (technology companies and media), and ISC BIND name servers (broad enterprise and ISP exposure).

Review your Citrix NetScaler exposure alongside this advisory. The Citrix NetScaler SAML zero-day covered on October 7 shows how rapidly China-linked actors pivot from one perimeter appliance class to another when new vulnerabilities become exploitable.

The following steps address both the immediate remediation required by the CISA October 11 deadline and the longer-term defensive controls that disrupt Flax Typhoon's full attack chain.