Flax Typhoon using legitimate software to quietly access Taiwanese organizations | Microsoft Security Blog

Microsoft Threat Intelligence details an active China-linked APT group named Flax Typhoon conducting a stealthy espionage-focused campaign against dozens of Taiwanese organizations by exploiting public-facing vulnerabilities, deploying web shells (e.g., China Chopper), using living-off-the-land tools and open-source privilege escalation utilities, and establishing robust persistence and C2 via renamed SoftEther VPN bridges tunneled over HTTPS; the report includes technical TTPs, IoCs (IP addresses and TLS fingerprints), hunting queries, and defensive/mitigation recommendations.