Microsoft says Chinese hacking crew is targeting Taiwan

A group dubbed Flax Typhoon has targeted "dozens" of Taiwanese organizations, according to new research from Microsoft.

Researchers at Microsoft said on Thursday that a hacking group with suspected links to the Chinese government is actively targeting dozens of organizations in Taiwan as part of a cyber espionage campaign.

Flax Typhoon, the name Microsoft uses to describe the group based in China, is working to gain and maintain long-term access to primarily Taiwanese organizations, although some victims have been observed in Southeast Asia, North America and Africa, the company said in a blog post Thursday. The group’s targets include government entities, manufacturing firms and tech companies.

The news comes on the heels of the Biden administration’s approval of a $500 million arms package to Taiwan and a new round of Chinese military drills near the island. Three months ago, Microsoft and a coalition of intelligence agencies revealed that Chinese-linked hackers targeted telecommunications systems in Guam as part of an operation that may have laid the groundwork for severing communications between the United States and its military assets in East Asia.

Thursday’s report from Microsoft describes a fairly stealthy actor that uses minimal amounts of malware in its operations and instead relies on tools already within victim systems, “along with some normally benign software.” Microsoft researchers have not observed the group using its access to Taiwanese systems to conduct additional operations but noted that the group is using “techniques that could be easily reused in other operations outside the region and would benefit from broader industry visibility.”

“Although our visibility into these threats has given us the ability to deploy detections to our customers, the lack of visibility into other parts of the actor’s activity compelled us to drive broader community awareness to further investigations and protections across the security ecosystem,” the company said in its blog.

Flax Typhoon has been active since mid-2021 and is known to use the China Chopper web shell, the researchers noted, which has also been used by Hafnium, a state-backed Chinese hacking group that successfully used multiple zero-day bugs in Microsoft Exchange Server software as part of an espionage campaign revealed in March 2021. Later that year, the FBI hacked victim servers to remove Hafnium malware.

Flax Typhoon has also been observed using Metasploit, a popular penetration testing framework; the Juicy Potato privilege escalation tool; Mimikatz, the data exfiltration tool; and the SoftEther virtual private network (VPN) client, according to Microsoft.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure