Chinese Hackers Use Geo-Mapping Tool for Year-Long Persistence
The China-backed advanced persistent threat group Flax Typhoon has maintained an extended access to an ArcGIS system by transforming trusted software into a persistent backdoor. This approach led the vendor to update its documentation.
The China-backed advanced persistent threat group Flax Typhoon has maintained an extended access to an ArcGIS system by transforming trusted software into a persistent backdoor. This approach led the vendor to update its documentation.
The attackers converted a legitimate Java server object extension into a web shell, protected access with a hardcoded key, and embedded it in backups to avoid detection.
The targeted ArcGIS system was used as a gateway to access interconnected systems, highlighting a risk for any public-facing application with backend access. Organizations are encouraged to move beyond indicator-of-compromise-based detection and consider public-facing applications as high-risk assets.
For over a year, Flax Typhoon demonstrated that attackers could utilize existing tools rather than developing their own. They adapted a geo-mapping application’s Java server object extension into a functioning web shell, achieving persistence that could survive full system recovery.
This backdoor facilitated hands-on-keyboard activity, enabling command execution, lateral movement, and credential harvesting across multiple hosts.
The attack exploited the inherent trust placed in legitimate software components. Instead of using known malicious tools, attackers repurposed a legitimate server object extension into a covert web shell, allowing movements to appear as normal operations and bypass detection tools focused on known-bad artifacts.
The same web shell was repeatedly used to execute additional encoded PowerShell commands via the “JavaSimpleRESTSOE” extension and “getLayerCountByType” operation.
Organizations are encouraged to move beyond indicator-of-compromise-based detection and consider public-facing applications as high-risk assets.
By incorporating a hardcoded key, Flax Typhoon prevented others from tampering with access, prompting a shift in security thinking from whether a file is malicious to whether an application is behaving as expected.
The persistence method was particularly insidious. By ensuring the compromised component was included in backups, the attackers turned recovery plans into guaranteed reinfection methods, making backups potential reinfection vectors.
ArcGIS: A Gateway to Critical Infrastructure
ArcGIS is a geographic information system used to visualize, analyze, and manage spatial data for critical functions such as disaster recovery, urban planning, and emergency management. The attackers compromised a portal administrator account and deployed a malicious SOE.
A single compromise can disrupt operations, expose sensitive infrastructure data, and provide gateways for lateral movement into interconnected enterprise and operational technology networks.
Although specialized applications like ArcGIS may escape heavy scrutiny, the weakness exploited exists in any public-facing application organizations consider safe. Secure products can be vulnerable if operating environments lack equal rigor. Vendor guidance should be treated as baselines, not comprehensive strategies. Organizations must harden applications assuming any feature can become a vulnerability.
Security researchers linked this attack with high confidence to Chinese APTs and moderate confidence to Flax Typhoon, also known as Ethereal Panda. The group uses SoftEther VPN to create VPN bridges and maintains persistent access often exceeding twelve months.
Flax Typhoon prioritizes persistence, lateral movement, and credential harvesting, typically gaining initial access by exploiting public-facing servers, deploying web shells, and establishing VPN connections . Activity aligns with Chinese business hours while attack sectors match previous patterns.
Active since at least 2021, Flax Typhoon conducts long dormancy periods for planning before executing precise attacks. The group consistently focuses on critical infrastructure, making this attribution significant.
Organizations must move beyond prevention and actively hunt for compromise signs, as experts assess that Flax Typhoon is likely active in new networks or planning its next victim. This attack underscores the need to question assumptions about trusted applications and implement behavioral monitoring to detect when legitimate tools are abused.
Artifact Details
172.86.117[.]230 C2 IP (SoftEther VPN Server) bridge.exe Renamed SoftEther VPN Bridge vpn_bridge.config SoftEther VPN Config File hamcore.se2 SoftEther Installation File 4f9d9a6cba88832fcb7cfb845472b63ff15cb9b417f4f02cb8086552c19ceffc File hash of bridge.exe 8282c5a177790422769b58b60704957286edb63a53a49a8f95cfa1accf53c861 File hash of vpn_bridge.config 84959fe39d655a9426b58b4d8c5ec1e038af932461ca85916d7adeed299de1b3 File hash of hamcore.se2 cec625f70d2816c85b1c6b3b449e4a84a5da432b75a99e9efa9acd6b9870b336 File hash of simplerestsoe.soe
Based on reporting by GBHackers.