File · Flax Typhoon · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06 · on the wire
Flax Typhoon
- Ethereal Panda
- Storm-0919
sigil · no ATT&CK coverage stated
Last 30 days
last seen 8 d agoWhat changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2015-3306
- —8 d agoresurfacedback on the wire — nothing in the previous 30 days
Analyst brief
misp-galaxyFlax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected. They exploit vulnerabilities in public-facing servers, use living-off-the-land techniques, and deploy a VPN connection to maintain persistence and move laterally within compromised networks.
CVEs reports attribute to Flax Typhoon
1 on CISA KEV- CVE-2015-3306KEVEPSS 98% · 2026-10-09
“Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306”
attributed by a report · named nearby · source: our dispatch · 2026-10-09
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
2 sourcesTrack Flax Typhoon on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.