Flax Typhoon: Raptor Train Botnet & ArcGIS Backdoor

Flax Typhoon is a China-linked state-sponsored hacking group that specializes in getting into networks quietly and staying there for years, using legitimate software and built-in system tools instead of obvious malware. It is best known for two things: operating the Raptor Train botnet of 260,000+ hijacked routers and IoT devices that the FBI dismantled in 2024, and a 2025 campaign that turned trusted ArcGIS mapping software into a hidden backdoor for over a year. This guide explains what Flax Typhoon is, how its living-off-the-land tradecraft works, its botnet and ArcGIS operations, who is really behind it, and how it fits alongside the other Chinese "Typhoon" groups, Volt and Salt.

Updated: September 2026. Reflects the 2024 FBI Raptor Train takedown, the Integrity Technology Group attribution and sanctions, and the 2025 ArcGIS backdoor campaign.

The quick answer

The one line to remember: Flax Typhoon's edge is patience and stealth, it burrows in with the tools you already trust and stays for years.

What is Flax Typhoon?

Flax Typhoon is an advanced persistent threat (APT) group attributed to the People's Republic of China. Microsoft first publicly detailed it in August 2023, describing how it quietly accessed Taiwanese organizations using legitimate software; other vendors track it as Ethereal Panda (CrowdStrike) and Storm-0919. Its defining trait, per the Council on Foreign Relations, is that it focuses on establishing and maintaining persistent access to networks rather than immediately stealing data or causing damage, classic pre-positioning for espionage.

Its primary targets are in Taiwan: government agencies, education, critical manufacturing, and IT organizations, though its botnet swept up victims worldwide. It is one of three major Chinese "Typhoon" groups, alongside Volt Typhoon (which pre-positions to disrupt US critical infrastructure) and Salt Typhoon (which spies on telecoms). Flax is the Taiwan-focused, persistence-obsessed member of the family.

Living off the land: how Flax Typhoon operates

Like its Typhoon siblings, Flax Typhoon's hallmark is living off the land (LOTL), achieving its goals with tools that are already present and trusted, so its activity blends into normal administration and leaves little for antivirus to catch.

The typical operation, per Microsoft and Lumen research, runs like this:

• Initial access through public-facing servers. It exploits known vulnerabilities in internet-facing services to get its first foothold.
• Persistence with legitimate tools. It deploys a VPN connection and uses built-in operating-system utilities to maintain access, rather than dropping custom implants that would raise alarms.
• Credential harvesting and lateral movement. It collects credentials and uses them to move quietly through the network with valid accounts.
• Long-term dwell. It dedicates ongoing effort to staying undetected, treating persistence itself as the objective.

Because there is little malware to scan for, defending against Flax Typhoon is about spotting anomalous use of legitimate tools and software, the same detection challenge covered in our attack surface management guidance.

The Raptor Train botnet and the FBI takedown

Flax Typhoon's most visible operation was the Raptor Train botnet, uncovered and named by Lumen's Black Lotus Labs. It was a sprawling network of hijacked small-office/home-office (SOHO) routers, IP cameras, DVRs, and network storage devices, infected with a Mirai-variant malware called Nosedive, used to relay and disguise the group's activity.

The numbers were striking:

In September 2024, the US Department of Justice ran a court-authorized operation that seized the botnet's infrastructure. FBI Director Christopher Wray announced the takedown at the Aspen Cyber Summit, and revealed the group's real-world identity. When the operators realized what was happening, they tried to migrate their bots to new servers and even launched a DDoS attack against the FBI, all of which failed. It was a decisive disruption, though, as with Volt Typhoon's KV-botnet, taking down infrastructure is not the same as evicting the actor.

The ArcGIS backdoor: a Flax Typhoon cyber operation

In 2025, researchers at ReliaQuest documented a strikingly clever Flax Typhoon campaign that showed the group's LOTL philosophy at its most refined. Instead of deploying malware, Flax Typhoon turned a legitimate enterprise application, Esri's ArcGIS geo-mapping software, into a backdoor.

The technique:

• It modified a Java Server Object Extension (SOE) within ArcGIS, a legitimate extensibility feature, into a functioning web shell.
• It gated access with a hardcoded key so only the operators could use it.
• Most insidiously, it embedded the malicious component in the system's own backups, so the backdoor could survive a full disaster-recovery restore.
• With that foothold, it moved laterally across hosts, executed commands, and harvested credentials, for more than a year before discovery.

This is the "flax typhoon arcgis" campaign that put the group back in headlines, and it is a defining case study in modern persistence: the attacker never brought a weapon, it repurposed the defender's own trusted software, and it poisoned the recovery mechanism so that "restore from backup" would reinstall the compromise. It is exactly why validating patch and configuration integrity of public-facing applications matters as much as scanning for malware.

Who is behind Flax Typhoon?

One of the most significant revelations of the 2024 takedown was attribution to a real company. The FBI identified the group's operations as run through Integrity Technology Group, a Beijing-based information-security company that used China Unicom IP addresses to control Raptor Train, a concrete example of China's "hacker-for-hire" contractor ecosystem, where nominally private firms carry out state cyber operations.

The response has been international:

• The US Treasury (OFAC) sanctioned Integrity Technology Group in January 2025 for its role in Flax Typhoon's activity.
• The European Union imposed its own sanctions in March 2026 on Integrity Technology and related entities for cyberattacks against EU member states and critical infrastructure.

Flax vs Volt vs Salt Typhoon

The three Chinese "Typhoon" groups share the LOTL playbook but pursue different missions. Telling them apart is the fastest way to understand China's cyber posture.

All three rely on hijacked routers and IoT devices and on living off the land, which is why edge-device security is the common thread in defending against every one of them, and the same holds for Russia's APT28 (Fancy Bear).

Flax Typhoon in 2026: current status

The Raptor Train botnet was disrupted, but Flax Typhoon itself remains an active espionage threat. The 2025 ArcGIS campaign showed the group evolving toward even stealthier, software-native persistence, and the ongoing sanctions and advisories indicate Western agencies still treat it as a live danger. The realistic assumption for organizations, especially in Taiwan and among their global suppliers, is that Flax Typhoon continues to seek quiet, long-term footholds, and that its next technique may again be a trusted piece of your own software.

How to defend against Flax Typhoon

Because Flax Typhoon avoids malware and lives in legitimate tools, defense centers on hardening the edge, scrutinizing your own software, and hunting for anomalies.

Two lessons from the ArcGIS case deserve emphasis. First, your trusted applications are attack surface, monitor their extensibility features and configurations, not just for known CVEs. Second, your backups can be poisoned, so validate their integrity, because a compromise embedded in a restore point defeats the very recovery you would rely on. Because the initial foothold almost always comes through an exposed, exploitable service, validating your external surface the way an attacker would is the highest-value step, which is what DeepStrike's external penetration testing delivers.

Why this matters for security teams

Flax Typhoon is a masterclass in patience: it does not smash and grab, it moves in and stays, using your own tools against you. For defenders, it collapses the comfortable idea that "no malware detected" means "no compromise." The group's edge is stealth and persistence, so the countermeasures are visibility, integrity checking, and hunting, plus the discipline to secure the routers, IoT, and public-facing software that these actors treat as their front door. A tested incident response plan then decides how quickly you can evict an actor that was never supposed to be found.

DeepStrike's penetration testing probes the exposed services, edge devices, and application configurations that groups like Flax Typhoon exploit, and shows you where a state-level actor could quietly gain and hold access. To scope an engagement, see our penetration testing services.

FAQ

What is Flax Typhoon?

Flax Typhoon is a Chinese state-sponsored hacking group (also called Ethereal Panda and Storm-0919) that specializes in quietly establishing long-term, persistent access to networks, primarily Taiwanese organizations, using living-off-the-land techniques. It is best known for operating the Raptor Train IoT botnet and for turning ArcGIS software into a year-long backdoor.

What was the Raptor Train botnet?

Raptor Train was a botnet operated by Flax Typhoon and named by Lumen's Black Lotus Labs. It infected over 260,000 SOHO routers, IP cameras, DVRs, and storage devices with Mirai-variant malware ("Nosedive") to relay and disguise the group's activity. The FBI disrupted it in a court-authorized operation in September 2024.

What is the Flax Typhoon ArcGIS attack?

In 2025, Flax Typhoon modified a legitimate Java Server Object Extension in Esri's ArcGIS mapping software into a hidden web shell, gated by a hardcoded key and embedded in system backups so it could survive a full recovery. This gave the group persistent access, lateral movement, and credential harvesting for over a year without deploying traditional malware.

Who is really behind Flax Typhoon?

The FBI attributed Flax Typhoon's operations to Integrity Technology Group, a Beijing-based information-security company that controlled the Raptor Train botnet using China Unicom IP addresses. It is an example of China's contractor ecosystem for state hacking. The US sanctioned the firm in January 2025 and the EU followed in March 2026.

How is Flax Typhoon different from Volt and Salt Typhoon?

All three are Chinese state-linked groups using living-off-the-land tradecraft, but their missions differ. Flax Typhoon focuses on persistent espionage access to Taiwanese organizations, Volt Typhoon pre-positions to disrupt US critical infrastructure, and Salt Typhoon spies on telecom networks. Flax is the persistence-and-botnet specialist of the trio.

Is Flax Typhoon still active in 2026?

Yes. Although the FBI disrupted its Raptor Train botnet in 2024, the group itself remains an active espionage threat, and its 2025 ArcGIS campaign showed it evolving toward stealthier, software-native persistence. Western agencies continue to issue advisories and sanctions against it and its operator, Integrity Technology Group.

How do organizations defend against Flax Typhoon?

Patch public-facing servers quickly, secure and retire vulnerable SOHO and IoT devices, monitor for anomalous use of legitimate tools, verify the integrity of application extensions and backups, centralize logging, and hunt proactively. Because Flax Typhoon avoids malware and lives in trusted software, visibility and integrity checking matter more than signature-based antivirus.