Security Resilience

Threat actor · all actors

Flax TyphoonMISP-50ee2b1b state

🇨🇳 CN

aka Flax Typhoon, Ethereal Panda, Storm-0919

Last updated: 2026-10-16

8attributed CVEs
0ATT&CK techniques
27.1IDF score (tooling uniqueness)
0exclusive CVEs
2014–2026years active

About this actor

Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon relies on tools built into the operating system and legitimate software to remain undetected. They exploit vulnerabilities in public-facing servers, use living-off-the-land techniques, and deploy a VPN connection to maintain persistence and move laterally within compromised networks.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

Microsoftweather-system names

Flax TyphoonStorm-0919

CrowdStrikenation-animal names

Ethereal Panda

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2014: 1 CVE published120142015: 2 CVE published220152016: 1 CVE published120162019: 1 CVE published120192021: 2 CVE published2021: 2 KEV added420212023: 1 CVE published120232025: 1 KEV added120252026: 5 KEV added52026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2015-3306 KEV10.010.00.99502015-05-18see CVE
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2021-22205 KEV10.010.00.99732021-04-23see CVE
CVE-2021-3199 KEV9.99.80.19352021-01-26see CVE
CVE-2014-6278 KEV9.28.80.99682014-09-30see CVE
CVE-2016-3081 KEV8.78.10.97512016-04-26see CVE
CVE-2015-5477 KEV8.57.50.99412015-07-29see CVE
CVE-2023-22894 KEV7.54.90.20962023-04-19see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category