APT Explorer

All actors

Flax Typhoon

Also reported as Ethereal Panda, RedJuliett, Storm-0919 and ETHEREAL PANDA. Linked to China by four sources.

Reports
25
Last reported
Known CVEs
35
Origin
China
ID
flax-typhoon
Sources
MISPETDAMalpediaMicrosoft
Merge evidence
10 alias matches

Reports per quarter

Dated reports, 2023 Q3 to 2026 Q2.

Techniques seen in the last two years

Show all 28 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 35 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Hackers stole 'sensitive' data from Taiwan telecom giant: ministry

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. NSA: Volt Typhoon was ‘not successful’ at persisting in critical infrastructure

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Flax Typhoon - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  5. Treasury Sanctions China-based Hacker Involved in the Compromise of Sensitive U.S. Victim Networks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Treasury Sanctions Technology Company for Support to Malicious Cyber Group

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Salt Typhoon: An Analysis of Vulnerabilities Exploited by this State-Sponsored Actor

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. 2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en

    file creation date ORKL

    Archived copy on ORKL Details

  9. eset-apt-activity-report-q2-2025-q3-2025.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Will the Real Salt Typhoon Please Stand Up?

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 25 reports Show fewer

  1. State Secrets for Sale: More Leaks from the Chinese Hack-for-Hire Industry

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. UAT-5918 targets critical infrastructure entities in Taiwan

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. ESET APT Activity Report Q2 2024-Q3 2024

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. 240918.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  6. redacted_24-mj-1484_signed_search_and_seizure_warrant_for_disclosure.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. CSA-PRC-LINKED-ACTORS-BOTNET.PDF

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Derailing the Raptor Train

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Flax Typhoon using legitimate software to quietly access Taiwanese organizations | Microsoft Security Blog

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  10. Chinese State-Sponsored RedJuliett Intensifies Taiwanese Government, Academic, and Technology Sector Cyber Espionage via Network Perimeter Exploitation

    file creation date ORKL

    Archived copy on ORKL Details

  11. ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

    file creation date ORKL

    Archived copy on ORKL Details

  12. APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. Microsoft Security Compliance and Identity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. Volt-Typhoon.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. Flax Typhoon using legitimate software to quietly access Taiwanese organizations | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.