Flax Typhoon: Chinese Cyber Espionage Botnet in Taiwan

Chinese cyber espionage in Taiwan is ongoing, but recently the Chinese state-sponsored group known as Flax Typhoon suffered a significant defeat when the botnet it operated was taken down. The hacking group abandoned its infrastructure after efforts from a joint operation by US federal agencies took control of the network. Flax Typhoon (aka Ethereal Panda, Red Juliett) has similarities to Volt Typhoon, which was discovered targeting US critical infrastructure. However, Flax Typhoon is targeting Taiwanese government entities, academic institutions, and technology sector companies. The Flax Typhoon group infects internet-facing devices such as routers, firewalls, network-attached storage (NAS), and Internet of Things (IoT) devices. The group has operated the botnet since 2021 and controlled around 260,000 devices.

Key Judgment 1. Chinese cyber espionage groups are highly likely to continue covert intelligence-gathering activities in Taiwan as regional tensions increase.

Key Judgment 2. Flax Typhoon is likely to begin immediate efforts to rebuild its infrastructure and botnet, following the take-down operation by the US federal authorities.

Key Judgment 3. US authorities will likely continue aggressive and coordinated counter-measures against Chinese espionage operations as tensions escalate with the United States.