Two PRC Hacking Contractors Disrupted in Ten Weeks
The FBI and DOJ dismantled the infrastructure of two separate PRC state-sponsored hacking contractors within ten weeks during the summer and fall of 2026. On August 26, the agencies seized three domains hard-coded into the QScan and QTRouter malware platforms, rendering them inoperable [11][12][13]. On October 8, they seized seven additional domains supporting Microscan and FishHub, two tools operated by Integrity Technology Group on behalf of Flax Typhoon [3][4][5][24]. Both operations targeted companies that sell hacking services directly to China's Ministry of State Security (MSS) and the People's Liberation Army (PLA) [11][22]. The August action hit Nanjing Xinjiuwei Network Technology Company and its QTFY group, whose confirmed targets included NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the US Senate [11][12]. The October action hit Integrity Technology Group, a publicly traded PRC-based company whose enabled actors compromised critical infrastructure and organizations across multiple countries, including Japanese airports, Taiwanese natural gas and power companies, and approximately 20 Taiwanese universities [3][4][5].
These were not isolated incidents. They represent the second and third public technical disruptions of PRC cyber contractors in two years, following the September 2024 court-authorized takedown of a botnet of more than 200,000 consumer devices also attributed to Integrity Tech [3]. The pattern now includes botnet disruption in 2024, indictments and domain seizures against i-Soon in 2025, an extradition in April 2026, and the dual strikes in August and October 2026 [3]. No individual was charged in either the August or October 2026 releases [3][12].
Background: The Contractor Model
PRC cyber operations rely on a commercial ecosystem of for-profit companies that build tools, acquire infrastructure, and compromise networks on behalf of state intelligence services [10][22]. Integrity Technology Group employs people who "acquire or build cyber tools for use and sale, acquire and host infrastructure, and compromise networks around the world," according to the joint advisory AA26-281A published by CISA, the FBI, the NSA, and agencies from the UK, Australia, Canada, Japan, New Zealand, and Spain [10]. The actors Integrity Tech enables use tactics consistent with activity publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett, though the authoring agencies caution that vendor tracking names do not map one-to-one to US government designations [3][10].
Nanjing Xinjiuwei, the company behind QTFY, counts both the MSS and the PLA among its paying customers [11]. Lumen Black Lotus Labs researcher Damon Rouse told The Hacker News the group has been active since May 2018 and has shown particular interest in academic and research targets [11].
Foreign Policy noted on November 3, 2026 that contractors supporting Chinese cyber operations "disappear and reemerge frequently, making disruption of any single actor insufficient to deter the wider ecosystem" [22]. The company disrupted in October 2026 had previously provided hacking services to both the PLA and the MSS, and others have conducted intrusions for the MSS and the Ministry of Public Security simultaneously [22].
Tooling: QScan, QTRouter, Microscan, and FishHub
QScan scanned the internet for vulnerable systems and automatically infected IoT devices, enrolling them into the QTRouter relay network [11][13]. QTRouter comprised compromised devices, commercial proxy services, and leased VPS nodes, using Clash to establish proxy connections that obscured the origin of attacks [11][13]. QScan included code for over 200 attacks and handled more than 2 million scanning or exploitation tasks in a single day in 2024, per the FBI affidavit [13]. The seized domains were hard-coded into both tools, so the seizures made QScan and QTRouter inoperable [12][13].
Microscan was Integrity Tech's vulnerability scanning platform, operated through a Mirai-variant botnet of hijacked IoT devices [4][5][8]. It carried over 1,300 penetration testing scripts targeting Oracle WebLogic, Apache Struts, WordPress, Jenkins, and Microsoft Exchange [8]. FishHub supported spear phishing: after an initial compromise, it downloaded additional malware onto the victim's network, giving clients remote access or searching for specific files to exfiltrate to Integrity Tech servers [3][5][6]. Five of the seven seized domains delivered the FishHub post-compromise tool [6]. After FishHub downloaded an initial file onto a victim's computer, the file retrieved additional malicious programs from those domains, created a file listing, searched for documents, compressed them, and exfiltrated data to an attacker-controlled server [6].
The Five KEV-Listed CVEs
CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on October 8, 2026, following confirmed abuse by Flax Typhoon [7][8][9]. Federal agencies had until October 11, 2026 to patch or retire the affected software under Binding Operational Directive 22-01 [8][9]. The oldest vulnerability dates to 2015.
| CVE | Product | CVSS | Required Action |
|---|---|---|---|
| CVE-2015-3306 | ProFTPD | 9.8 | Upgrade to 1.3.5a or later; disable mod_copy [7][8] |
| CVE-2021-3199 | ONLYOFFICE Docs | 9.8 | Patch JWT path traversal via image upload parameter [7][8] |
| CVE-2016-3081 | Apache Struts | 8.1 | Upgrade to 2.3.28.1 or later; disable Dynamic Method Invocation [7][8] |
| CVE-2015-5477 | ISC BIND | 7.5 | Upgrade to 9.9.7-P2 or 9.10.2-P3 [7][8] |
| CVE-2023-22894 | Strapi | 7.2 | Upgrade to 4.8.0 or later [7][8] |
The advisory lists eight total CVEs successfully exploited by Integrity Tech-enabled actors, with five newly added to KEV [10]. Affected software also includes Bash, Pulse Connect Secure, and GitLab [10].
Exchange Mailbox Theft Tradecraft
Advisory AA26-281A describes a separate intrusion pattern that does not depend on the five CVEs above. The actors password-sprayed Microsoft Exchange servers with the open-source tool EBurst, then exfiltrated email using scripts [27][28]. A PHP bot called Curlc4 pulled mail through Exchange Web Services [27]. Victims of the email theft included government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia [27]. In some cases the stolen mail could only be opened from IP addresses in Xiamen, China [27]. The FBI says it recovered an archived email database the actors used to target victim mailboxes [27].
For persistence, actors installed SoftEther VPN clients disguised as conhost.exe or dllhost.exe to maintain startup-persistent remote access [28]. Data theft combined the Curlc4 component and email collection scripts with DCSync credential harvesting through a tool named DC.exe [28].
PRC-Manufactured Devices: Structural Access That Persists
A February 2025 DHS intelligence assessment (DHS-IA-IF-2025-02684) states there are tens of thousands of PRC-manufactured cameras on the networks of US critical infrastructure entities, including within the chemical and energy sectors, some connected to operational technology (OT) networks [14][15]. These devices typically lack data encryption and security settings and have default configurations that communicate with their manufacturer [14][15]. In March 2024, a US oil and natural gas firm's PRC-made cameras communicated with China-based servers, including one possibly associated with a PRC state-sponsored cyber actor, according to ODNI's Commercial Cyber Threat Intelligence Program [14][16].
The DHS assessment warns: "A cyber actor could use cameras placed on safety systems to suppress alarms, trigger false alarms, or pivot to disable fail-safe mechanisms" [15][16]. China has used white labeling to circumvent US regulators, importing cameras repackaged and sold by other companies [15][16].
A GAO report (GAO-26-107668) found that DOD components identified more than 300 video surveillance devices connected to DOD's IT network manufactured by one of five PRC-linked entities listed under Section 889, with DOD determining over 40 percent of this equipment posed high risk due to placement in secure locations [17]. A separate 2019 DOD video surveillance inventory found more than 1,000 PRC-manufactured surveillance devices not connected to DOD's IT network [17].
Regulatory Actions Through 2026
On March 23, 2026, the FCC added "routers produced in a foreign country" to its Covered List, blocking new FCC equipment authorization for foreign-made routers unless granted a Conditional Approval by DHS [19][20]. The FCC cited the involvement of foreign-made routers in the Volt Typhoon, Flax Typhoon, and Salt Typhoon cyberattacks on US infrastructure [20].
In June 2026, the US Department of Defense added TP-Link to a list of Chinese military-linked companies [19]. In January 2026, the Texas governor prohibited TP-Link products on all state government devices and networks, and in February 2026 the Texas attorney general filed suit against TP-Link alleging deceptive marketing and backdoor access for the Chinese government [19]. By October 2026, four US states had sued TP-Link over security concerns [19]. As of October 8, 2026, no federal order bans existing TP-Link routers from use [20].
The FY2027 NDAA House bill (H.R. 8800), passed July 22, 2026 by a 216 to 212 vote, contains provisions that would bar the Department of Defense from buying or using specific technologies tied to China, including humanoid robots, blockchain networks, semiconductors made on Chinese silicon carbide wafers, and Chinese optical fiber [18]. Section 1814 would bar optical fiber or cable produced, manufactured, or assembled by PRC-linked entities for use in Department of Defense networks and communications systems [18]. The Senate has not yet passed its companion bill [18].
IOC Table
| Type | Value | Context | Source |
|---|---|---|---|
| domain | c0cc[.]cc |
Seized Microscan/Flax Typhoon C2 domain | [24][25] |
| domain | 98aiblog[.]com |
Seized Flax Typhoon FishHub domain | [24] |
| domain | 98aicai[.]com |
Seized Flax Typhoon FishHub domain | [24] |
| domain | 98aicode[.]com |
Seized Flax Typhoon FishHub domain | [24] |
| domain | outlook3650[.]com |
Seized Flax Typhoon FishHub phishing domain | [24] |
| domain | youtubecard[.]com |
Seized Flax Typhoon FishHub domain | [24] |
| domain | linkedinns[.]net |
Seized Flax Typhoon phishing domain | [24] |
| domain | w8510[.]com |
Flax Typhoon Raptor Train C2 domain from 2024 reporting (subdomains used for botnet C2); not among the seven domains seized in October 2026 | [24] |
| domain | x.c0cc[.]cc |
Subdomain serving Microscan logger | [27] |
| IP | 202.182.109[.]151 |
Raptor Train C2 server (1.2M+ device records as of June 2024) | [24] |
| filename | DiagTrack.exe |
Credential-harvesting malware disguised as legitimate Windows telemetry process | [27][28] |
| filename | Curlc4.txt |
PHP bot component for Exchange email collection | [27][28] |
| filename | DC.exe |
DCSync credential harvesting tool | [28] |
| filename | dllhost.exe |
Disguised SoftEther VPN client for persistence | [28] |
| filename | conhost.exe |
Disguised SoftEther VPN client for persistence | [28] |
| filename | live700_v1.exe |
Credential-phish payload delivered in ZIP | [27] |
| filename | sethc.exe |
Sticky Keys persistence hijack | [28] |
| filename | vpnbridge.exe |
Renamed SoftEther VPN bridge executable | [28] |
| tool | Clash |
Legitimate proxy tool abused by QTRouter for relay connections | [11] |
MITRE ATT&CK Mapping
| Technique ID | Name | Context |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Exploitation of ProFTPD, Struts, ONLYOFFICE, Strapi, BIND, Pulse Connect Secure, GitLab [7][8][10] |
| T1566 | Phishing | FishHub spear-phishing platform delivers initial payloads [3][5] |
| T1595.002 | Active Scanning: Vulnerability Scanning | Microscan automated scanning with 1,300+ scripts; QScan 2M+ tasks/day [8][13] |
| T1583.003 | Acquire Infrastructure: Virtual Private Server | QTRouter uses leased VPS in relay network [13] |
| T1584.005 | Compromise Infrastructure: Botnet | Mirai-variant botnet enrolls IoT devices for C2 relay [4][11] |
| T1078 | Valid Accounts | EBurst password spraying against Exchange to obtain credentials [27][28] |
| T1133 | External Remote Services | SoftEther VPN clients installed for persistent remote access [28] |
| T1036.005 | Masquerading: Match Legitimate Name or Location | SoftEther VPN disguised as conhost.exe and dllhost.exe [28] |
| T1546.008 | Event Triggered Execution: Accessibility Features | Sticky Keys (sethc.exe) persistence technique |
| T1003.006 | OS Credential Dumping: DCSync | DCSync credential harvesting via DC.exe [28] |
| T1114.002 | Email Collection: Remote Email Collection | Curlc4 PHP bot and scripts exfiltrate Exchange mailboxes [27][28] |
| T1105 | Ingress Tool Transfer | FishHub downloads additional malware post-compromise [3][6] |
| T1572 | Protocol Tunneling | SoftEther VPN tunnels for C2 and data exfiltration [28] |
| T1543.003 | Create or Modify System Process: Windows Service | SoftEther VPN configured for startup persistence [28] |
Detection and Hunting
Seized domain and C2 monitoring. Block and alert on all seven seized Flax Typhoon domains (c0cc[.]cc, 98aiblog[.]com, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net) and the Raptor Train C2 domain w8510[.]com plus subdomains [24]. STIX-format IOCs were published with the advisory [10]. Block QTFY domains (qt-proxy.org, qt-team.com, qtproxy.xyz) and their subdomains at the DNS layer [11].
SoftEther VPN detection. Search for processes named vpnclient.exe, vpnserver.exe, vpncmd.exe, or vpnbridge.exe running outside of approved VPN deployments. Also hunt for SoftEther binaries renamed to conhost.exe or dllhost.exe by comparing file hashes against known SoftEther distributions [28].
title: SoftEther VPN Binary Masquerading as System Process
id: a7f3c2d1-8e4b-4a1f-9c5d-2b6e8f0a3d7c
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects SoftEther VPN binaries running under names typically used by legitimate Windows processes, consistent with Flax Typhoon persistence
logsource:
category: process_creation
product: windows
detection:
selection_name:
Image|endswith:
- '\conhost.exe'
- '\dllhost.exe'
filter_legit_path:
Image|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
selection_softether_strings:
CommandLine|contains:
- 'vpn_'
- 'SoftEther'
- '/SERVER'
- '/CLIENT'
condition: (selection_name and not filter_legit_path) or (selection_name and selection_softether_strings)
level: high
tags:
- attack.defense_evasion
- attack.t1036.005
- attack.persistence
- attack.t1133EBurst password spray detection. Monitor Exchange and Office 365 authentication logs for high volumes of failed logon attempts across multiple mailboxes from a small number of source IPs, followed by successful authentication. The advisory describes EBurst as an open-source tool for password spraying Exchange servers [27][28].
Sticky Keys persistence. Alert on modifications to C:\Windows\System32\sethc.exe, particularly replacement with non-Microsoft binaries. Compare the file hash of sethc.exe against the known-good hash for the OS build.
PRC camera telemetry. Audit network traffic from IP cameras for connections to Chinese IP space or manufacturer callback domains. Cross-reference camera make and model against the five PRC-linked entities listed under Section 889 [14][17]. Cameras on OT networks warrant priority review.
KEV patching verification. Scan for the five newly listed CVEs. ProFTPD instances older than 1.3.5a, Apache Struts with Dynamic Method Invocation enabled, unpatched ONLYOFFICE Docs, Strapi below 4.8.0, and BIND below 9.9.7-P2 or 9.10.2-P3 are all confirmed exploitation targets [7][8].
Analysis
Two data points frame the current situation. First, the US government has now publicly disrupted PRC cyber contractor infrastructure three times in two years, each time seizing domains and rendering specific tools inoperable [3][12][22]. Second, contractors supporting Chinese cyber operations reconstitute infrastructure and continue operations after each disruption [22]. As Foreign Policy reported: "Disruption alone cannot reverse the strategic advantages generated by years of Chinese cyber activity" [22].
The contractor model gives the PRC deniability and redundancy. Integrity Tech and Nanjing Xinjiuwei operate as commercial entities that sell capabilities to multiple state customers. When one tool is seized, the company retains its personnel, its exploitation research, and its relationships with the MSS and PLA. The domain seizures deny infrastructure because registries and registrars are within the reach of US legal process [3]. They do not deny the capability to rebuild.
The hardware problem is even harder to solve through disruption. DOD has identified more than 300 PRC-manufactured surveillance devices on its IT network and over 1,000 more not connected to IT networks [17]. Tens of thousands of PRC-made cameras remain on critical infrastructure networks across the chemical and energy sectors [14][15]. Legislative and regulatory responses are underway, including the FCC's March 2026 foreign router rule [20] and pending NDAA provisions [18], but available evidence suggests the installed base of PRC hardware was never fully inventoried, let alone removed [17].
In February 2026, OT security provider Dragos reported that Chinese state-sponsored actors continue attempts to compromise US critical infrastructure, including a group overlapping with Flax Typhoon [2]. Advisory AA26-281A lists targets across US Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology sectors, plus law enforcement, education, and religious organizations [10].
Red Sheep Assessment
Confidence: Moderate
The two disruptions in August and October 2026 represent the most aggressive US operational tempo against PRC cyber contractors to date. The sources collectively suggest, but do not state, that these actions are sequenced components of a broader campaign to map and dismantle the PRC's commercial hacking supply chain, following the i-Soon indictments in 2025 and the April 2026 extradition [3][22].
That said, the structural problem has not changed. The PRC's intelligence laws compel cooperation from any company or individual on Chinese soil, which means every PRC-manufactured device on a US network is a potential collection platform by legal design, not by exploitation [14][15]. The regulatory responses (FCC router rule, DOD Section 889 searches, pending NDAA provisions) address procurement of new hardware. They do not fund or mandate removal of existing deployed equipment. The GAO found that DOD's search methods, including IT network scans, may not cover entire IT networks, including classified networks [17].
An alternative interpretation: the rapid cadence of public disruptions may itself be the primary objective, intended to impose reputational and operational costs on PRC contractors and to deter new companies from entering the market. The charging and extradition actions against i-Soon personnel support this reading [3]. The risk is that this strategy may force the PRC to shift to contractors with no public profile, making future attribution harder.
The five KEV-listed CVEs, some dating to 2015, signal that Flax Typhoon preferentially targets organizations running legacy software with known, unpatched vulnerabilities [7][8]. This is a resource-efficient approach: the scanning infrastructure (Microscan with 1,300+ scripts, QScan with 200+ attack modules) automates discovery at scale [8][13]. Patching these specific CVEs reduces the attack surface against this specific actor set. It does not address the password-spraying and Exchange mailbox theft tradecraft documented in AA26-281A, which requires no vulnerability exploitation at all [27][28].
Defender's Checklist
- ▢[ ] Block seized and known C2 domains at DNS and proxy layers. Add all seven Flax Typhoon domains,
w8510[.]complus subdomains, and QTFY domains (qt-proxy.org,qt-team.com,qtproxy.xyz) to blocklists. Ingest STIX IOCs from AA26-281A [10][24].
- ▢[ ] Patch or retire the five KEV-listed products. ProFTPD below 1.3.5a, Apache Struts with DMI enabled, ONLYOFFICE Docs (CVE-2021-3199), Strapi below 4.8.0, and ISC BIND below 9.9.7-P2 or 9.10.2-P3. The federal deadline was October 11; private sector organizations with these products in production face the same exploitation [7][8].
- ▢[ ] Hunt for SoftEther VPN masquerading as system processes. Query endpoint telemetry for
conhost.exeordllhost.exerunning outsideC:\Windows\System32\orSysWOW64\. Validate file hashes against known SoftEther distributions [28].
- ▢[ ] Audit Exchange and O365 authentication logs for password spray patterns. Look for high-volume failed authentication attempts across multiple accounts from few source IPs, followed by successful logons. Search for the EBurst tool name in process or command-line logs [27][28].
- ▢[ ] Inventory PRC-manufactured cameras and IoT devices on enterprise networks. Cross-reference against the five Section 889 entities. Prioritize any devices on OT network segments. Check for outbound connections to Chinese IP ranges or manufacturer callback domains [14][17].
References
[1] https://www.theregister.com/security/2026/10/08/us-disrupts-chinese-hacking-tools-as-7-govts-warn-of-prc-spies-stealing-sensitive-data-worldwide/5302107
[2] https://www.theregister.com/security/2026/10/08/us-disrupts-chinese-hacking-tools-as-7-govts-warn-of-prc-spies-stealing-sensitive-data-worldwide/5302107
[3] https://www.jlcw.org/articles/integrity-tech-domain-seizures-aa26-281a-state-contractor-model
[4] https://www.paubox.com/blog/doj-and-fbi-seize-hacking-tools-tied-to-chinas-flax-typhoon
[5] https://www.paubox.com/blog/fbi-seizes-phishing-and-scanning-tools-tied-to-chinese-contractor
[6] https://finance.biggo.com/news/f8e5b44f-988b-4edc-b409-10b6318f541c
[7] https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html
[8] https://byteiota.com/flax-typhoon-cisa-five-cves/
[9] https://news.lavx.hu/article/cisa-orders-federal-agencies-to-patch-five-flaws-exploited-by-flax-typhoon-by-oct-11
[10] https://www.redtigersecurity.com/advisory/aa26-281a-integrity-tech-prc-actors
[11] https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
[12] https://www.cnbc.com/2026/08/26/china-hacker-federal-reserve-doj-nasa.html
[13] https://sesamedisk.com/fbi-agency-domain-seizures-cybersecurity/
[14] https://wwema.org/wp-content/uploads/2025/02/Cybersecurity-DHS-IA-IF-2025-Peoples-Republic-of-China-Exploitation-of-Internet-Connected-Cameras.pdf
[15] https://abcnews.com/US/internet-connected-cameras-made-china-spy-us-infrastructure/story?id=118533418
[16] https://www.whio.com/news/national/internet-connected/WBL7WOQYLLGSEHRAFH3P64I75U/
[17] https://files.gao.gov/reports/GAO-26-107668/index.html
[18] https://www.tradecomplianceresourcehub.com/2026/11/02/congress-returns-national-security-and-trade-provisions-to-watch-in-the-fy2027-ndaa/
[19] https://en.wikipedia.org/wiki/TP-Link
[20] https://ismyroutersafe.com/is-tp-link-being-banned/
[21] https://www.tomshardware.com/networking/routers/tp-link-routers-face-potential-u-s-ban-over-alleged-china-related-national-security-concerns-company-vigorously-disputes-department-of-commerces-findings
[22] https://foreignpolicy.com/2026/11/03/china-cyberattacks-united-states-deterrence-hackers-competition
[23] https://www.decryptiondigest.com/blog/flax-typhoon-integrity-tech-fbi-seizure-cisa-patch
[24] https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html
[25] https://tech-blog-eight-blush.vercel.app/posts/2026-10-11-fbi-seizes-flax-typhoon-hacking-infrastructure/
[26] https://onsiteglobalmedia.us/flax-typhoon-hacking-tools-seized-integrity-tech/
[27] https://www.gblock.app/articles/integrity-tech-flax-typhoon-fishhub-eburst-seizure-2026
[28] https://www.picussecurity.com/resource/blog/cisa-aa26-281a-how-chinese-government-linked-actors-steal-sensitive-data
Hunt Guide: PRC State Contractors Flax Typhoon and QTFY, Integrity Tech and Nanjing Xinjiuwei Infrastructure and Tradecraft
Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.
Hypothesis: If Flax Typhoon, QTFY, or associated PRC state contractor actors are active in our environment, we expect to observe DNS queries or network connections to seized and known C2 domains (c0cc.cc, w8510.com, outlook3650.com, linkedinns.net, qt-proxy.org, and others), SoftEther VPN binaries masquerading as conhost.exe or dllhost.exe outside of System32, password-spray patterns against Exchange servers, DCSync credential harvesting via DC.exe, Sticky Keys persistence modifications to sethc.exe, and exploitation attempts against the five KEV-listed CVEs in Sysmon process creation logs, DNS logs, authentication event logs, and network connection metadata.
Intelligence Summary: The FBI and DOJ seized ten domains across two operations in August and October 2026, disrupting the QScan/QTRouter and Microscan/FishHub toolsets operated by PRC state contractors Nanjing Xinjiuwei (QTFY) and Integrity Technology Group (Flax Typhoon) on behalf of the MSS and PLA. Integrity Tech actors additionally conducted Exchange mailbox theft using the EBurst password-spray tool and Curlc4 PHP bot, maintained persistence via SoftEther VPN clients disguised as system processes, and harvested credentials with DCSync. CISA added five CVEs to the KEV catalog (CVE-2015-3306, CVE-2021-3199, CVE-2016-3081, CVE-2015-5477, CVE-2023-22894) following confirmed exploitation by these actors, and a joint advisory (AA26-281A) from eight nations details the broader tradecraft.
Confidence: Moderate | Priority: Critical
Scope
- Networks: All enterprise networks including DMZ segments hosting Exchange, web applications, and internet-facing services. OT network segments with IP cameras or IoT devices. Critical infrastructure segments (healthcare systems, energy sector, research/academic networks).
- Timeframe: 90 days lookback from current date. The August 2026 QTFY disruption and October 2026 Flax Typhoon disruption are the anchoring events; pre-compromise activity may predate these by months or years given the actors have been active since at least 2018.
- Priority Systems: Microsoft Exchange servers (on-premises), domain controllers (DCSync targets), internet-facing web applications (ProFTPD, Apache Struts, ONLYOFFICE, Strapi, BIND, GitLab, Pulse Connect Secure), PRC-manufactured IP cameras and IoT devices on OT networks, systems with SoftEther VPN installed.
MITRE ATT&CK Techniques
T1190: Exploit Public-Facing Application (Initial Access) [P2]
Flax Typhoon and QTFY actors exploit public-facing applications using automated scanning infrastructure (Microscan with 1,300+ scripts, QScan with 200+ attack modules). Confirmed exploitation targets include ProFTPD (CVE-2015-3306), Apache Struts (CVE-2016-3081), ONLYOFFICE Docs (CVE-2021-3199), Strapi (CVE-2023-22894), ISC BIND (CVE-2015-5477), Pulse Connect Secure, and GitLab.
Splunk SPL:
index=corelight sourcetype=corelight_http (uri="*struts*" OR uri="*weblogic*" OR uri="*wp-admin*" OR uri="*jenkins*" OR uri="*owa*" OR uri="*exchange*") status_code>=400
| stats count dc(id.orig_h) as src_count by uri id.resp_h status_code
| where count > 20 OR src_count > 5
| sort -count
| table uri id.resp_h status_code count src_countElastic KQL:
event.dataset:"zeek.http" AND (url.path:*struts* OR url.path:*weblogic* OR url.path:*wp-admin* OR url.path:*jenkins* OR url.path:*owa* OR url.path:*exchange*) AND http.response.status_code >= 400Sigma Rule:
title: Mass Exploitation Scanning Against Known Vulnerable Web Applications
id: b2c4e1f3-7d9a-4b8c-a6e2-1f5d3c8a9b0e
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects high-volume scanning or exploitation attempts against web applications known to be targeted by Flax Typhoon and QTFY actors, including Apache Struts, WebLogic, WordPress, Jenkins, and Exchange
logsource:
category: webserver
product: apache
detection:
selection:
cs-uri-query|contains:
- 'struts'
- 'weblogic'
- 'jenkins'
- 'wp-login'
- 'owa/auth'
condition: selection
level: medium
tags:
- attack.initial_access
- attack.t1190Tune by excluding known vulnerability scanners (e.g., Nessus, Qualys source IPs). High false positive rate in environments with active pen testing. Correlate with firewall-pan threat logs for confirmed exploit attempts.
T1566: Phishing (Initial Access) [P1]
FishHub is Integrity Tech's spear-phishing platform. Five of seven seized domains delivered FishHub post-compromise payloads. The domains outlook3650.com and linkedinns.net impersonate legitimate services. The payload live700_v1.exe was delivered in ZIP archives.
Splunk SPL:
index=sysmon EventCode=11 (TargetFilename="*live700_v1.exe*" OR TargetFilename="*DiagTrack.exe*" OR TargetFilename="*Curlc4*" OR TargetFilename="*Css.js*" OR TargetFilename="*M2k.js*" OR TargetFilename="*M2k_list.js*" OR TargetFilename="*M2k_ui_adm.js*")
| table _time Computer User TargetFilename Image
| sort _timeElastic KQL:
event.code:"11" AND (file.name:("live700_v1.exe" OR "DiagTrack.exe" OR "Curlc4.txt" OR "Css.js" OR "M2k.js" OR "M2k_list.js" OR "M2k_ui_adm.js"))Sigma Rule:
title: FishHub and Flax Typhoon Payload File Creation
id: c3d5e2f4-8a1b-4c9d-b7f3-2g6e4d9b0c1f
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects creation of files associated with the FishHub post-compromise toolset and Flax Typhoon credential-harvesting payloads
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- '\live700_v1.exe'
- '\DiagTrack.exe'
- '\Curlc4.txt'
- '\Css.js'
- '\M2k.js'
- '\M2k_list.js'
- '\M2k_ui_adm.js'
condition: selection
level: high
tags:
- attack.initial_access
- attack.t1566
- attack.executionDiagTrack.exe is a legitimate Windows process; alert only on instances created outside of C:\Windows\System32\DiagTrack\ or with unexpected hashes. Curlc4.txt is a PHP bot component, not a standard text file.
T1036.005: Masquerading: Match Legitimate Name or Location (Defense Evasion) [P1]
Flax Typhoon installs SoftEther VPN clients disguised as conhost.exe or dllhost.exe for startup-persistent remote access. Legitimate conhost.exe and dllhost.exe reside in C:\Windows\System32; any instance running from another path is suspicious.
Splunk SPL:
index=sysmon EventCode=1 (Image="*\\conhost.exe" OR Image="*\\dllhost.exe")
NOT (Image="C:\\Windows\\System32\\conhost.exe" OR Image="C:\\Windows\\SysWOW64\\conhost.exe" OR Image="C:\\Windows\\System32\\dllhost.exe" OR Image="C:\\Windows\\SysWOW64\\dllhost.exe")
| table _time Computer User Image ParentImage CommandLine Hashes
| sort _timeElastic KQL:
(process.name:"conhost.exe" OR process.name:"dllhost.exe") AND NOT (process.executable:"C:\\Windows\\System32\\conhost.exe" OR process.executable:"C:\\Windows\\SysWOW64\\conhost.exe" OR process.executable:"C:\\Windows\\System32\\dllhost.exe" OR process.executable:"C:\\Windows\\SysWOW64\\dllhost.exe")Sigma Rule:
title: SoftEther VPN Binary Masquerading as System Process
id: a7f3c2d1-8e4b-4a1f-9c5d-2b6e8f0a3d7c
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects SoftEther VPN binaries running under names typically used by legitimate Windows processes, consistent with Flax Typhoon persistence
logsource:
category: process_creation
product: windows
detection:
selection_name:
Image|endswith:
- '\conhost.exe'
- '\dllhost.exe'
filter_legit_path:
Image|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
selection_softether_strings:
CommandLine|contains:
- 'vpn_'
- 'SoftEther'
- '/SERVER'
- '/CLIENT'
condition: (selection_name and not filter_legit_path) or (selection_name and selection_softether_strings)
level: high
tags:
- attack.defense_evasion
- attack.t1036.005
- attack.persistence
- attack.t1133Compare file hashes of any hits against known SoftEther distributions (available from SoftEther GitHub releases). Legitimate conhost.exe is spawned by csrss.exe; deviations in parent process are additional evidence.
T1133: External Remote Services (Persistence) [P1]
Flax Typhoon actors install SoftEther VPN clients and bridges (vpnclient.exe, vpnserver.exe, vpncmd.exe, vpnbridge.exe) for persistent remote access. These are configured for startup persistence, often renamed to masquerade as system processes.
Splunk SPL:
index=sysmon EventCode=1 (Image="*vpnclient.exe" OR Image="*vpnserver.exe" OR Image="*vpncmd.exe" OR Image="*vpnbridge.exe" OR CommandLine="*SoftEther*" OR CommandLine="*vpn_*")
| table _time Computer User Image ParentImage CommandLine Hashes
| sort _timeElastic KQL:
(process.name:("vpnclient.exe" OR "vpnserver.exe" OR "vpncmd.exe" OR "vpnbridge.exe")) OR (process.command_line:*SoftEther* OR process.command_line:*vpn_*)Sigma Rule:
title: SoftEther VPN Executable Detection
id: d4e6f3g5-9b2c-4d0e-c8g4-3h7f5e0c2d3g
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects execution of SoftEther VPN binaries commonly used by Flax Typhoon for persistent remote access
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\vpnclient.exe'
- '\vpnserver.exe'
- '\vpncmd.exe'
- '\vpnbridge.exe'
condition: selection
level: high
tags:
- attack.persistence
- attack.t1133
- attack.t1572Whitelist approved VPN deployments by path. SoftEther VPN is a legitimate tool; the detection should trigger review, not automatic blocking, unless the organization has no authorized SoftEther deployment.
T1078: Valid Accounts (Initial Access) [P2]
Flax Typhoon actors use the open-source EBurst tool to password-spray Microsoft Exchange servers. Successful authentication provides mailbox access for the Curlc4 email collection component.
Splunk SPL:
index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4625 LogonType=10
| bin _time span=5m
| stats count dc(TargetUserName) as unique_accounts values(TargetUserName) as targeted_accounts by _time IpAddress
| where count > 50 AND unique_accounts > 10
| sort -count
| table _time IpAddress count unique_accounts targeted_accountsElastic KQL:
event.code:"4625" AND winlog.event_data.LogonType:"10" | stats count by source.ip, @timestampSigma Rule:
title: Password Spray Against Exchange - High Volume Failed Logons
id: e5f7g4h6-0c3d-4e1f-d9h5-4i8g6f1d3e4h
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects potential password spray activity characterized by many failed logon attempts across multiple accounts from few source IPs, consistent with EBurst tool usage by Flax Typhoon
logsource:
product: windows
service: security
detection:
selection:
EventID: 4625
condition: selection | count() by IpAddress > 50
level: high
tags:
- attack.credential_access
- attack.t1078
- attack.t1110.003Threshold of 50 failed logons per 5-minute window across 10+ unique accounts is a starting point; tune based on environment baseline. Follow up by checking for successful logon (4624) from the same source IP within the subsequent 30 minutes. Also search process creation logs for EBurst in command lines.
T1003.001: OS Credential Dumping: LSASS Memory (Credential Access) [P1]
Flax Typhoon uses a tool named DC.exe to perform DCSync credential harvesting, replicating Active Directory credentials from domain controllers.
Splunk SPL:
index=sysmon EventCode=1 (Image="*\\DC.exe" OR CommandLine="*DC.exe*" OR CommandLine="*mimikatz*" OR CommandLine="*lsadump::dcsync*" OR CommandLine="*secretsdump*")
| table _time Computer User Image ParentImage CommandLine Hashes
| sort _timeElastic KQL:
(process.name:"DC.exe" OR process.command_line:(*dcsync* OR *secretsdump* OR *mimikatz*)) AND event.code:"1"Sigma Rule:
title: DCSync Tool Execution - DC.exe or Known DCSync Commands
id: f6g8h5i7-1d4e-4f2g-e0i6-5j9h7g2e4f5i
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects execution of DC.exe or known DCSync-related command-line strings associated with Flax Typhoon credential harvesting
logsource:
category: process_creation
product: windows
detection:
selection_dc_exe:
Image|endswith: '\DC.exe'
selection_dcsync:
CommandLine|contains:
- 'lsadump::dcsync'
- 'secretsdump'
condition: selection_dc_exe or selection_dcsync
level: critical
tags:
- attack.credential_access
- attack.t1003.006
- attack.t1003.001DC.exe is a generic filename; correlate with hash values if available. Also monitor Windows Security EventID 4662 for directory replication requests (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) from non-domain-controller sources.
T1546.008: Event Triggered Execution: Accessibility Features (Persistence) [P1]
Flax Typhoon actors replace sethc.exe (Sticky Keys) with a malicious binary or backdoor to gain access at the Windows logon screen without credentials.
Splunk SPL:
index=sysmon (EventCode=11 TargetFilename="*\\sethc.exe") OR (EventCode=1 Image="*\\sethc.exe" ParentImage!="*\\winlogon.exe")
| table _time Computer User EventCode Image TargetFilename ParentImage CommandLine Hashes
| sort _timeElastic KQL:
(event.code:"11" AND file.path:*sethc.exe) OR (event.code:"1" AND process.name:"sethc.exe" AND NOT process.parent.name:"winlogon.exe")Sigma Rule:
title: Sticky Keys Binary Replacement or Suspicious Execution
id: g7h9i6j8-2e5f-4g3h-f1j7-6k0i8h3f5g6j
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects modification of sethc.exe or execution of sethc.exe by an unexpected parent process, indicating Sticky Keys persistence hijack
logsource:
category: file_event
product: windows
detection:
selection_file:
TargetFilename|endswith: '\sethc.exe'
EventType: 'creation'
condition: selection_file
level: critical
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1546.008The legitimate sethc.exe should only be modified during Windows updates. Compare the hash of sethc.exe against the known-good hash for the specific OS build. Any mismatch warrants immediate investigation.
T1114.002: Email Collection: Remote Email Collection (Collection) [P2]
Flax Typhoon actors use the Curlc4 PHP bot to pull mail through Exchange Web Services (EWS). Scripts collect, compress, and exfiltrate mailbox contents. In some intrusions, stolen mail could only be opened from IP addresses in Xiamen, China.
Splunk SPL:
index=corelight sourcetype=corelight_http host="*exchange*" OR host="*owa*" OR host="*mail*"
(uri="*/ews/*" OR uri="*/EWS/*" OR uri="*/autodiscover*")
| stats count dc(id.orig_h) as unique_sources values(id.orig_h) as src_ips by id.resp_h uri
| where count > 100
| sort -count
| table id.resp_h uri count unique_sources src_ipsElastic KQL:
url.path:("/ews/" OR "/EWS/" OR "/autodiscover/") AND destination.domain:(*exchange* OR *owa* OR *mail*)Sigma Rule:
title: High Volume Exchange Web Services Access - Potential Email Exfiltration
id: h8i0j7k9-3f6g-4h4i-g2k8-7l1j9i4g6h7k
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects high-volume access to Exchange Web Services endpoints, potentially indicating automated email collection by Curlc4 or similar tools
logsource:
category: webserver
product: iis
detection:
selection:
cs-uri-stem|contains:
- '/ews/'
- '/EWS/'
condition: selection
level: medium
tags:
- attack.collection
- attack.t1114.002Baseline normal EWS usage volumes before alerting. Legitimate EWS clients (Outlook, mobile sync) generate significant traffic. Focus on access from unexpected source IPs, especially those geolocated to China.
T1105: Ingress Tool Transfer (Command and Control) [P1]
After FishHub establishes initial access, it downloads additional malware from attacker-controlled domains (five of the seven seized domains). The initial file retrieves additional malicious programs, creates file listings, searches for documents, compresses them, and exfiltrates data.
Splunk SPL:
index=corelight sourcetype=corelight_dns query IN ("c0cc.cc", "x.c0cc.cc", "98aiblog.com", "98aicai.com", "98aicode.com", "outlook3650.com", "youtubecard.com", "linkedinns.net", "w8510.com", "qt-proxy.org", "qt-team.com", "qtproxy.xyz", "fastlink.ws")
| table _time id.orig_h query answers
| sort _timeElastic KQL:
dns.question.name:("c0cc.cc" OR "x.c0cc.cc" OR "98aiblog.com" OR "98aicai.com" OR "98aicode.com" OR "outlook3650.com" OR "youtubecard.com" OR "linkedinns.net" OR "w8510.com" OR "qt-proxy.org" OR "qt-team.com" OR "qtproxy.xyz" OR "fastlink.ws")Sigma Rule:
title: DNS Query to Flax Typhoon or QTFY Known C2 Domain
id: i9j1k8l0-4g7h-4i5j-h3l9-8m2k0j5h7i8l
status: experimental
author: RedSheepSec
date: 2026/11/04
description: Detects DNS resolution attempts for domains associated with Flax Typhoon FishHub/Microscan and QTFY QScan/QTRouter infrastructure
logsource:
category: dns
detection:
selection:
query|endswith:
- '.c0cc.cc'
- '.98aiblog.com'
- '.98aicai.com'
- '.98aicode.com'
- '.outlook3650.com'
- '.youtubecard.com'
- '.linkedinns.net'
- '.w8510.com'
- '.qt-proxy.org'
- '.qt-team.com'
- '.qtproxy.xyz'
- '.fastlink.ws'
selection_exact:
query:
- 'c0cc.cc'
- '98aiblog.com'
- '98aicai.com'
- '98aicode.com'
- 'outlook3650.com'
- 'youtubecard.com'
- 'linkedinns.net'
- 'w8510.com'
- 'qt-proxy.org'
- 'qt-team.com'
- 'qtproxy.xyz'
- 'fastlink.ws'
condition: selection or selection_exact
level: critical
tags:
- attack.command_and_control
- attack.t1105
- attack.t1071.001These domains were seized by the FBI/DOJ and should not resolve to legitimate services. Any DNS query for them indicates a host was previously or is currently compromised. Investigate the source host immediately.
T1572: Protocol Tunneling (Command and Control) [P2]
Flax Typhoon uses SoftEther VPN tunnels for C2 and data exfiltration. QTRouter uses Clash proxy tool to establish proxy connections that obscure the origin of attacks through compromised devices, commercial proxy services, and leased VPS nodes.
Splunk SPL:
index=corelight sourcetype=corelight_ssl server_name IN ("c0cc.cc", "w8510.com", "qt-proxy.org", "qt-team.com", "qtproxy.xyz")
| table _time id.orig_h id.resp_h id.resp_p server_name
| sort _timeElastic KQL:
tls.client.server_name:("c0cc.cc" OR "w8510.com" OR "qt-proxy.org" OR "qt-team.com" OR "qtproxy.xyz")Correlate SoftEther VPN detection results with network connection logs to identify tunnel destinations. SoftEther VPN uses port 443 by default, making it blend with HTTPS traffic.
T1595.002: Active Scanning: Vulnerability Scanning (Reconnaissance) [P1]
Microscan operated through a Mirai-variant botnet with over 1,300 penetration testing scripts. QScan included code for over 200 attacks and handled more than 2 million scanning or exploitation tasks in a single day in 2024.
Splunk SPL:
index=firewall-pan sourcetype="pan:threat" (src_ip IN ("202.182.109.151", "198.13.53.226", "208.85.16.100", "45.77.231.209", "139.180.137.219", "45.135.117.131", "155.138.151.225", "222.186.48.201", "222.186.48.204"))
| stats count values(dest_ip) as targets dc(dest_ip) as target_count by src_ip action category
| sort -count
| table src_ip action category count target_count targetsElastic KQL:
source.ip:("202.182.109.151" OR "198.13.53.226" OR "208.85.16.100" OR "45.77.231.209" OR "139.180.137.219" OR "45.135.117.131" OR "155.138.151.225" OR "222.186.48.201" OR "222.186.48.204")These IPs are associated with Raptor Train botnet C2 and Flax Typhoon scanning infrastructure. Any inbound connection from these IPs warrants blocking and investigation of the targeted service.
T1543.003: Create or Modify System Process: Windows Service (Persistence) [P1]
SoftEther VPN is configured for startup persistence as a Windows service. Actors install it under service names that mimic legitimate system services.
Splunk SPL:
index=winevent EventCode=7045 (ServiceFileName="*vpnclient*" OR ServiceFileName="*vpnserver*" OR ServiceFileName="*vpnbridge*" OR ServiceFileName="*SoftEther*" OR ServiceFileName="*conhost.exe*" OR ServiceFileName="*dllhost.exe*")
NOT ServiceFileName="C:\\Windows\\System32\\*"
| table _time Computer ServiceName ServiceFileName ServiceType
| sort _timeElastic KQL:
event.code:"7045" AND (winlog.event_data.ImagePath:(*vpnclient* OR *vpnserver* OR *vpnbridge* OR *SoftEther*))Service installation events (7045) from sysmon or winevent are high-fidelity indicators. Correlate with process creation events for the same executable path.
Indicators of Compromise
| Type | Value | Context | |
|---|---|---|---|
| domain | c0cc.cc |
Seized Microscan/Flax Typhoon C2 domain used to access the Microscan scanning tool \ | VirusTotal 10/92 malicious |
| domain | x.c0cc.cc |
Subdomain serving Microscan logger component \ | VirusTotal 0/92 malicious |
| domain | 98aiblog.com |
Seized Flax Typhoon FishHub malware C2 domain \ | VirusTotal 10/92 malicious |
| domain | 98aicai.com |
Seized Flax Typhoon FishHub domain \ | VirusTotal 12/92 malicious |
| domain | 98aicode.com |
Seized Flax Typhoon FishHub domain \ | VirusTotal 3/92 malicious |
| domain | outlook3650.com |
Seized Flax Typhoon FishHub phishing domain impersonating Microsoft Outlook \ | VirusTotal 12/92 malicious |
| domain | youtubecard.com |
Seized Flax Typhoon FishHub domain \ | VirusTotal 8/92 malicious |
| domain | linkedinns.net |
Seized Flax Typhoon phishing domain impersonating LinkedIn \ | VirusTotal 8/92 malicious |
| domain | w8510.com |
Flax Typhoon Raptor Train C2 domain with subdomains used for botnet command and control \ | VirusTotal 12/92 malicious |
| domain | qt-proxy.org |
QTFY QScan infrastructure domain, VirusTotal 15/92 malicious | |
| domain | mq-task.qt-proxy.org |
QTFY QScan task server domain, VirusTotal 15/92 malicious | |
| domain | mq-task.qt-team.com |
QTFY QScan task server domain, VirusTotal 15/92 malicious | |
| domain | mq-result.qt-proxy.org |
QTFY QScan result collection domain, VirusTotal 16/92 malicious | |
| domain | mq-result.qt-team.com |
QTFY QScan result collection domain, VirusTotal 13/92 malicious | |
| domain | www.qtproxy.xyz |
QTFY QTRouter malware admin server, VirusTotal 13/92 malicious | |
| domain | securelink.qtproxy.xyz |
QTFY QTRouter malware admin server, VirusTotal 14/92 malicious | |
| domain | fastlink.ws |
QTFY proxy infrastructure domain used in relay network \ | VirusTotal 0/92 malicious |
| domain | c.speedtest.net |
PRC-linked Raptor Train/Flax Typhoon botnet malware performs connectivity checks via this domain \ | VirusTotal 0/92 malicious |
| ip | 202.182.109.151 |
Raptor Train C2 server with 1.2M+ device records as of June 2024 \ | AbuseIPDB confidence 0% (0 reports, JP) |
| ip | 198.13.53.226 |
Flax Typhoon scanning tool hosting IP \ | AbuseIPDB confidence 0% (0 reports, JP) |
| ip | 208.85.16.100 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, ES) |
| ip | 45.77.231.209 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 139.180.137.219 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, SG) |
| ip | 45.135.117.131 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 155.138.151.225 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, CA) |
| ip | 222.186.48.201 |
Flax Typhoon w8510.com C2 subdomain IP, geolocated to CN \ | AbuseIPDB confidence 0% (0 reports, CN) |
| ip | 222.186.48.204 |
Flax Typhoon w8510.com C2 subdomain IP, geolocated to CN \ | AbuseIPDB confidence 0% (0 reports, CN) |
| ip | 92.38.185.45 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 85.90.216.115 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, FR) |
| ip | 195.234.62.197 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, DE) |
| ip | 85.90.216.69 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, FR) |
| ip | 85.90.216.110 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, FR) |
| ip | 207.148.122.69 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, SG) |
| ip | 45.10.58.129 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 92.38.185.46 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 85.90.216.116 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, FR) |
| ip | 45.10.58.133 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 195.234.62.184 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, DE) |
| ip | 149.248.51.22 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, CA) |
| ip | 37.61.229.15 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 5.181.27.219 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 78.141.238.97 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 92.38.185.43 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 37.9.35.91 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 45.92.70.71 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, IT) |
| ip | 195.234.62.188 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (1 reports, DE) |
| ip | 195.234.62.198 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, DE) |
| ip | 195.234.62.192 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, DE) |
| ip | 45.10.58.130 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 37.61.229.17 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 92.38.185.44 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 155.138.133.56 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, CA) |
| ip | 45.92.70.68 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, IT) |
| ip | 45.135.117.136 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, US) |
| ip | 45.10.58.132 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, GB) |
| ip | 207.148.68.131 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, SG) |
| ip | 108.61.177.81 |
Flax Typhoon w8510.com C2 subdomain IP \ | AbuseIPDB confidence 0% (0 reports, FR) |
| filename | DiagTrack.exe |
XSS credential-harvesting malware disguised as legitimate Windows Diagnostics Tracking Service process | |
| filename | Curlc4.txt |
PHP bot component used for Exchange email collection via EWS | |
| filename | DC.exe |
DCSync credential harvesting tool used by Flax Typhoon | |
| filename | dllhost.exe |
Disguised SoftEther VPN client for persistence; legitimate only in System32 | |
| filename | conhost.exe |
Disguised SoftEther VPN client for persistence; legitimate only in System32 | |
| filename | live700_v1.exe |
Credential-phish payload delivered in ZIP archives by FishHub | |
| filename | sethc.exe |
Sticky Keys persistence hijack target; replacement indicates T1546.008 | |
| filename | vpnbridge.exe |
Renamed SoftEther VPN bridge executable used for tunneled C2 | |
| filename | vpnclient.exe |
SoftEther VPN client process used by Flax Typhoon for persistence | |
| filename | vpnserver.exe |
SoftEther VPN server process used by Flax Typhoon | |
| filename | vpncmd.exe |
SoftEther VPN command-line tool used by Flax Typhoon | |
| filename | Css.js |
Flax Typhoon staged exfiltration file disguise | |
| filename | M2k.js |
Flax Typhoon staged exfiltration file disguise | |
| filename | oneforall.py |
Subdomain discovery tool used by Flax Typhoon actors | |
| filename | M2k_list.js |
Flax Typhoon staged email dump filename | |
| filename | M2k_ui_adm.js |
Flax Typhoon staged email dump filename |
IOC Sweep Queries (Splunk):
index=corelight sourcetype=corelight_dns query="c0cc.cc" OR query="*.c0cc.cc"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="x.c0cc.cc"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="98aiblog.com" OR query="*.98aiblog.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="98aicai.com" OR query="*.98aicai.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="98aicode.com" OR query="*.98aicode.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="outlook3650.com" OR query="*.outlook3650.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="youtubecard.com" OR query="*.youtubecard.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="linkedinns.net" OR query="*.linkedinns.net"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="w8510.com" OR query="*.w8510.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="qt-proxy.org" OR query="*.qt-proxy.org"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="mq-task.qt-proxy.org"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="mq-task.qt-team.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="mq-result.qt-proxy.org"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="mq-result.qt-team.com"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="www.qtproxy.xyz" OR query="qtproxy.xyz" OR query="*.qtproxy.xyz"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="securelink.qtproxy.xyz"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="fastlink.ws" OR query="*.fastlink.ws"
| table _time id.orig_h query answers
| sort _timeindex=corelight sourcetype=corelight_dns query="c.speedtest.net"
| stats count by id.orig_h
| where count > 50
| table id.orig_h count(index=corelight sourcetype=corelight_conn id.resp_h="202.182.109.151") OR (index=firewall-pan dest_ip="202.182.109.151" OR src_ip="202.182.109.151")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="198.13.53.226") OR (index=firewall-pan dest_ip="198.13.53.226" OR src_ip="198.13.53.226")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="208.85.16.100") OR (index=firewall-pan dest_ip="208.85.16.100" OR src_ip="208.85.16.100")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.77.231.209") OR (index=firewall-pan dest_ip="45.77.231.209" OR src_ip="45.77.231.209")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="139.180.137.219") OR (index=firewall-pan dest_ip="139.180.137.219" OR src_ip="139.180.137.219")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.135.117.131") OR (index=firewall-pan dest_ip="45.135.117.131" OR src_ip="45.135.117.131")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="155.138.151.225") OR (index=firewall-pan dest_ip="155.138.151.225" OR src_ip="155.138.151.225")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="222.186.48.201") OR (index=firewall-pan dest_ip="222.186.48.201" OR src_ip="222.186.48.201")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="222.186.48.204") OR (index=firewall-pan dest_ip="222.186.48.204" OR src_ip="222.186.48.204")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="92.38.185.45") OR (index=firewall-pan dest_ip="92.38.185.45" OR src_ip="92.38.185.45")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="85.90.216.115") OR (index=firewall-pan dest_ip="85.90.216.115" OR src_ip="85.90.216.115")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="195.234.62.197") OR (index=firewall-pan dest_ip="195.234.62.197" OR src_ip="195.234.62.197")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="85.90.216.69") OR (index=firewall-pan dest_ip="85.90.216.69" OR src_ip="85.90.216.69")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="85.90.216.110") OR (index=firewall-pan dest_ip="85.90.216.110" OR src_ip="85.90.216.110")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="207.148.122.69") OR (index=firewall-pan dest_ip="207.148.122.69" OR src_ip="207.148.122.69")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.10.58.129") OR (index=firewall-pan dest_ip="45.10.58.129" OR src_ip="45.10.58.129")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="92.38.185.46") OR (index=firewall-pan dest_ip="92.38.185.46" OR src_ip="92.38.185.46")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="85.90.216.116") OR (index=firewall-pan dest_ip="85.90.216.116" OR src_ip="85.90.216.116")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.10.58.133") OR (index=firewall-pan dest_ip="45.10.58.133" OR src_ip="45.10.58.133")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="195.234.62.184") OR (index=firewall-pan dest_ip="195.234.62.184" OR src_ip="195.234.62.184")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="149.248.51.22") OR (index=firewall-pan dest_ip="149.248.51.22" OR src_ip="149.248.51.22")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="37.61.229.15") OR (index=firewall-pan dest_ip="37.61.229.15" OR src_ip="37.61.229.15")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="5.181.27.219") OR (index=firewall-pan dest_ip="5.181.27.219" OR src_ip="5.181.27.219")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="78.141.238.97") OR (index=firewall-pan dest_ip="78.141.238.97" OR src_ip="78.141.238.97")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="92.38.185.43") OR (index=firewall-pan dest_ip="92.38.185.43" OR src_ip="92.38.185.43")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="37.9.35.91") OR (index=firewall-pan dest_ip="37.9.35.91" OR src_ip="37.9.35.91")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.92.70.71") OR (index=firewall-pan dest_ip="45.92.70.71" OR src_ip="45.92.70.71")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="195.234.62.188") OR (index=firewall-pan dest_ip="195.234.62.188" OR src_ip="195.234.62.188")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="195.234.62.198") OR (index=firewall-pan dest_ip="195.234.62.198" OR src_ip="195.234.62.198")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="195.234.62.192") OR (index=firewall-pan dest_ip="195.234.62.192" OR src_ip="195.234.62.192")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.10.58.130") OR (index=firewall-pan dest_ip="45.10.58.130" OR src_ip="45.10.58.130")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="37.61.229.17") OR (index=firewall-pan dest_ip="37.61.229.17" OR src_ip="37.61.229.17")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="92.38.185.44") OR (index=firewall-pan dest_ip="92.38.185.44" OR src_ip="92.38.185.44")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="155.138.133.56") OR (index=firewall-pan dest_ip="155.138.133.56" OR src_ip="155.138.133.56")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.92.70.68") OR (index=firewall-pan dest_ip="45.92.70.68" OR src_ip="45.92.70.68")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.135.117.136") OR (index=firewall-pan dest_ip="45.135.117.136" OR src_ip="45.135.117.136")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="45.10.58.132") OR (index=firewall-pan dest_ip="45.10.58.132" OR src_ip="45.10.58.132")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="207.148.68.131") OR (index=firewall-pan dest_ip="207.148.68.131" OR src_ip="207.148.68.131")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _time(index=corelight sourcetype=corelight_conn id.resp_h="108.61.177.81") OR (index=firewall-pan dest_ip="108.61.177.81" OR src_ip="108.61.177.81")
| table _time id.orig_h id.resp_h id.resp_p proto
| sort _timeindex=sysmon EventCode=1 Image="*DiagTrack.exe" NOT Image="C:\\Windows\\System32\\DiagTrack\\*"
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon (EventCode=1 CommandLine="*Curlc4*") OR (EventCode=11 TargetFilename="*Curlc4*")
| table _time Computer User Image TargetFilename CommandLineindex=sysmon EventCode=1 Image="*\\DC.exe"
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon EventCode=1 Image="*\\dllhost.exe" NOT (Image="C:\\Windows\\System32\\dllhost.exe" OR Image="C:\\Windows\\SysWOW64\\dllhost.exe")
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon EventCode=1 Image="*\\conhost.exe" NOT (Image="C:\\Windows\\System32\\conhost.exe" OR Image="C:\\Windows\\SysWOW64\\conhost.exe")
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon (EventCode=1 Image="*live700_v1.exe") OR (EventCode=11 TargetFilename="*live700_v1.exe")
| table _time Computer User Image TargetFilename CommandLineindex=sysmon EventCode=11 TargetFilename="*\\sethc.exe"
| table _time Computer User Image TargetFilename Hashesindex=sysmon EventCode=1 Image="*vpnbridge.exe"
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon EventCode=1 Image="*vpnclient.exe"
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon EventCode=1 Image="*vpnserver.exe"
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon EventCode=1 Image="*vpncmd.exe"
| table _time Computer User Image ParentImage CommandLine Hashesindex=sysmon EventCode=11 TargetFilename="*\\Css.js"
| table _time Computer User Image TargetFilenameindex=sysmon EventCode=11 TargetFilename="*\\M2k.js"
| table _time Computer User Image TargetFilenameindex=sysmon EventCode=1 CommandLine="*oneforall*"
| table _time Computer User Image CommandLineindex=sysmon EventCode=11 TargetFilename="*\\M2k_list.js"
| table _time Computer User Image TargetFilenameindex=sysmon EventCode=11 TargetFilename="*\\M2k_ui_adm.js"
| table _time Computer User Image TargetFilenameYARA Rules
flax_typhoon_fishhub_payload_indicators: Detects files associated with Flax Typhoon FishHub post-compromise toolset based on known filenames and string patterns
rule flax_typhoon_fishhub_payload_indicators {
meta:
author = "RedSheepSec"
description = "Detects Flax Typhoon FishHub payload indicators and associated credential-harvesting tools"
date = "2026-11-04"
reference = "CISA AA26-281A"
tlp = "white"
strings:
$fn1 = "live700_v1.exe" ascii wide nocase
$fn2 = "DiagTrack.exe" ascii wide nocase
$fn3 = "Curlc4" ascii wide nocase
$fn4 = "FishHub" ascii wide nocase
$fn5 = "M2k_list.js" ascii wide nocase
$fn6 = "M2k_ui_adm.js" ascii wide nocase
$d1 = "98aiblog.com" ascii wide
$d2 = "98aicai.com" ascii wide
$d3 = "98aicode.com" ascii wide
$d4 = "outlook3650.com" ascii wide
$d5 = "youtubecard.com" ascii wide
$d6 = "linkedinns.net" ascii wide
$d7 = "c0cc.cc" ascii wide
condition:
uint16(0) == 0x5A4D and (any of ($fn*) and any of ($d*)) or (3 of ($d*))
}qtfy_qscan_qtrouter_domains: Detects binaries containing QTFY QScan/QTRouter infrastructure domain strings
rule qtfy_qscan_qtrouter_domains {
meta:
author = "RedSheepSec"
description = "Detects QTFY QScan and QTRouter malware by matching hard-coded infrastructure domains"
date = "2026-11-04"
reference = "FBI domain seizure Aug 2026"
tlp = "white"
strings:
$d1 = "qt-proxy.org" ascii wide
$d2 = "qt-team.com" ascii wide
$d3 = "qtproxy.xyz" ascii wide
$d4 = "fastlink.ws" ascii wide
$d5 = "mq-task" ascii wide
$d6 = "mq-result" ascii wide
$s1 = "QScan" ascii wide
$s2 = "QTRouter" ascii wide
condition:
uint16(0) == 0x5A4D and (2 of ($d*) or (1 of ($s*) and 1 of ($d*)))
}softether_vpn_masquerading: Detects SoftEther VPN binaries that may have been renamed to masquerade as system processes
rule softether_vpn_masquerading {
meta:
author = "RedSheepSec"
description = "Detects SoftEther VPN binaries by internal strings, regardless of filename"
date = "2026-11-04"
reference = "CISA AA26-281A Flax Typhoon persistence"
tlp = "white"
strings:
$s1 = "SoftEther VPN" ascii wide
$s2 = "SoftEther Corporation" ascii wide
$s3 = "vpn_client.config" ascii wide
$s4 = "vpn_server.config" ascii wide
$s5 = "vpnbridge" ascii wide
$s6 = "SE_VPN_" ascii wide
condition:
uint16(0) == 0x5A4D and 2 of them
}Suricata Rules
SID 2026001: DNS query for seized Flax Typhoon C2 domain c0cc.cc
alert dns $HOME_NET any -> any any (msg:"ET TROJAN Flax Typhoon C2 Domain (c0cc.cc) DNS Query"; dns.query; content:"c0cc.cc"; nocase; sid:2026001; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a;)SID 2026002: DNS query for seized Flax Typhoon FishHub domain outlook3650.com
alert dns $HOME_NET any -> any any (msg:"ET TROJAN Flax Typhoon FishHub Domain (outlook3650.com) DNS Query"; dns.query; content:"outlook3650.com"; nocase; sid:2026002; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026003: DNS query for seized Flax Typhoon phishing domain linkedinns.net
alert dns $HOME_NET any -> any any (msg:"ET TROJAN Flax Typhoon Phishing Domain (linkedinns.net) DNS Query"; dns.query; content:"linkedinns.net"; nocase; sid:2026003; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026004: DNS query for Flax Typhoon Raptor Train C2 domain w8510.com
alert dns $HOME_NET any -> any any (msg:"ET TROJAN Flax Typhoon Raptor Train C2 Domain (w8510.com) DNS Query"; dns.query; content:"w8510.com"; nocase; sid:2026004; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026005: DNS query for QTFY infrastructure domain qt-proxy.org
alert dns $HOME_NET any -> any any (msg:"ET TROJAN QTFY QScan Infrastructure (qt-proxy.org) DNS Query"; dns.query; content:"qt-proxy.org"; nocase; sid:2026005; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026006: Outbound connection to Raptor Train C2 IP 202.182.109.151
alert ip $HOME_NET any -> 202.182.109.151 any (msg:"ET TROJAN Flax Typhoon Raptor Train C2 IP"; sid:2026006; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026007: Outbound connection to Flax Typhoon scanning host 198.13.53.226
alert ip $HOME_NET any -> 198.13.53.226 any (msg:"ET TROJAN Flax Typhoon Scanning Host IP"; sid:2026007; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026008: DNS query for Flax Typhoon FishHub domain 98aiblog.com
alert dns $HOME_NET any -> any any (msg:"ET TROJAN Flax Typhoon FishHub Domain (98aiblog.com) DNS Query"; dns.query; content:"98aiblog.com"; nocase; sid:2026008; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026009: DNS query for QTFY infrastructure domain qtproxy.xyz
alert dns $HOME_NET any -> any any (msg:"ET TROJAN QTFY QTRouter Infrastructure (qtproxy.xyz) DNS Query"; dns.query; content:"qtproxy.xyz"; nocase; sid:2026009; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)SID 2026010: Outbound connection to Flax Typhoon C2 IPs in CN range 222.186.48.0/24
alert ip $HOME_NET any -> [222.186.48.201,222.186.48.204] any (msg:"ET TROJAN Flax Typhoon C2 IP (CN 222.186.48.x)"; sid:2026010; rev:1; metadata:created_at 2026_11_04; classtype:trojan-activity;)Data Source Requirements
| Source | Required For | Notes |
|---|---|---|
| Sysmon (EventID 1, 3, 7, 11) | T1036.005, T1133, T1546.008, T1003.001, T1566, T1543.003, T1105 | Sysmon with process creation (1), network connection (3), image load (7), and file create (11) logging enabled. Hash logging (MD5, SHA256) must be enabled for masquerading detection. Available in index=sysmon. |
| Windows Security Event Log (EventID 4624, 4625, 4662, 7045) | T1078, T1003.001, T1543.003 | Required for password spray detection (4625), successful logon correlation (4624), DCSync detection (4662 with DS-Replication rights), and service installation (7045). Available in index=winevent. |
| Corelight/Zeek DNS | T1105, T1572, T1595.002 | DNS query logs for C2 domain detection. Available in index=corelight sourcetype=corelight_dns. |
| Corelight/Zeek HTTP | T1190, T1114.002 | HTTP request metadata for exploitation and EWS access detection. Available in index=corelight sourcetype=corelight_http. |
| Corelight/Zeek SSL | T1572 | TLS/SSL connection metadata for encrypted tunnel detection. Available in index=corelight sourcetype=corelight_ssl. |
| Corelight/Zeek Conn | T1595.002, T1105 | Network connection metadata for IP-based IOC sweeps. Available in index=corelight sourcetype=corelight_conn. |
| Palo Alto Firewall | T1190, T1595.002 | Threat and traffic logs for inbound exploitation attempts and outbound C2 connections. Available in index=firewall-pan. |
| CrowdStrike EDR | T1036.005, T1133, T1003.001 | Endpoint detection for process masquerading, VPN tool execution, and credential dumping. Available in index=crowdstrike. |
| Exchange IIS/Web Server Logs | T1114.002, T1078 | Exchange server access logs for EWS abuse detection. Available in index=iis or index=webserver. |
| Azure AD / M365 Sign-in Logs | T1078 | Cloud authentication logs for password spray detection against Exchange Online. Available in index=cloud-azure. |
Mitigations & Recommendations
Curated baseline: Volt Typhoon; library archetype
Established mitigations (curated):
- Eviction kickoff requires CISO approval and participation from: Identity team, AD team, Network team, EDR team, Exchange/M365 team, and edge-appliance vendor support.
- Simultaneously disable ALL compromised accounts (user + service). Revoke ALL sessions and tokens.
- krbtgt reset TWICE (12 hours apart). Required since attacker had NTDS access.
- Reset ALL domain passwords (force all users to change on next logon).
- Block ALL known Volt Typhoon infrastructure: CISA-published IPs, domains, KV Botnet relay ranges. Apply at perimeter, DNS, proxy.
- Isolate compromised hosts at EDR. Do NOT attempt in-place cleaning; they are rebuild targets.
Established detection guidance (curated):
- DO NOT alert the actor. No account disables, no password resets, no host isolation, no emails about the investigation on normal corporate channels. Use out-of-band comms only.
- Hunt Volt Typhoon signature LOLBin pattern: ntdsutil, wmic, reg save, netsh port proxy, tasklist, ipconfig, net user/group, whoami.
- Hunt for credential dumping via ntdsutil (DC database extraction).
- Look for netsh port proxy rules establishing attacker pivots.
- Egress to SOHO router / KV Botnet relay IPs. Check for authenticated sign-ins from ASNs associated with residential or small-business ISPs (Comcast, AT&T residential, various global ISPs).
- Review public-facing edge devices for CVE exposure matching known Volt Typhoon entry vectors (Fortinet FortiGuard, Ivanti Pulse/Connect Secure, Cisco, Versa Director).
Net-new from this incident:
- Block all seized and known C2 domains at DNS and proxy layers: c0cc.cc, 98aiblog.com, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, w8510.com and subdomains, qt-proxy.org, qt-team.com, qtproxy.xyz, fastlink.ws, and all subdomains. Ingest STIX-format IOCs from AA26-281A into threat intelligence platforms.
- Patch or retire systems running ProFTPD below 1.3.5a (CVE-2015-3306), Apache Struts with Dynamic Method Invocation enabled (CVE-2016-3081), ONLYOFFICE Docs with JWT path traversal (CVE-2021-3199), Strapi below 4.8.0 (CVE-2023-22894), and ISC BIND below 9.9.7-P2 or 9.10.2-P3 (CVE-2015-5477). Also patch Pulse Connect Secure and GitLab instances per AA26-281A.
- Deploy the SoftEther VPN masquerading detection (Sigma rule a7f3c2d1) and SoftEther VPN executable detection (Sigma rule d4e6f3g5) across all Sysmon-instrumented endpoints. Add Windows service installation monitoring (EventID 7045) for SoftEther-related service names.
- Implement password-spray detection on all Exchange and O365 authentication log sources, tuned to detect high-volume failed logon attempts across multiple accounts from few source IPs. Search process creation logs for references to EBurst.
- Validate the integrity of sethc.exe on all Windows endpoints by comparing file hashes against known-good values for each OS build. Alert on any file write events targeting sethc.exe.
- Inventory all PRC-manufactured cameras and IoT devices on enterprise and OT networks. Cross-reference against the five Section 889 entities. Prioritize removal or network isolation of any such devices on OT segments or in sensitive facilities.
- Add all 35+ Raptor Train C2 IP addresses to firewall block rules and threat intelligence feeds. Monitor for any historical connections in 90-day lookback windows.
- Deploy Suricata rules (SIDs 2026001-2026010) on network sensors monitoring DMZ and internet egress points.
Sources
- The Register: US Disrupts Chinese Hacking Tools
- JLCW: Integrity Tech Domain Seizures and AA26-281A Analysis
- Paubox: DOJ and FBI Seize Hacking Tools Tied to China's Flax Typhoon
- Paubox: FBI Seizes Phishing and Scanning Tools Tied to Chinese Contractor
- Biggo Finance: FishHub Domain Seizure Details
- The Hacker News: Flax Typhoon Exploits Five Flaws
- ByteIota: Flax Typhoon CISA Five CVEs
- LAVX News: CISA Orders Federal Agencies to Patch Five Flaws
- Red Tiger Security: Advisory AA26-281A Analysis
- The Hacker News: FBI Disrupts China-Linked QTFY
- CNBC: China Hacker Federal Reserve DOJ NASA
- SesameDisk: FBI Agency Domain Seizures
- DHS Intelligence Assessment: PRC Exploitation of Internet-Connected Cameras
- ABC News: Internet-Connected Cameras Made in China
- WHIO: Internet Connected PRC Cameras
- GAO Report GAO-26-107668: DOD Video Surveillance Devices
- Trade Compliance Resource Hub: FY2027 NDAA Provisions
- Wikipedia: TP-Link
- IsMyRouterSafe: TP-Link Ban Status
- Tom's Hardware: TP-Link Routers Ban
- Foreign Policy: China Cyberattacks Deterrence
- Decryption Digest: Flax Typhoon Integrity Tech FBI Seizure CISA Patch
- The Hacker News: FBI Seizes 7 Domains Disrupts Flax Typhoon
- Tech Blog: FBI Seizes Flax Typhoon Hacking Infrastructure
- Forkast: Federal Agencies Face Deadline to Patch Five Flax Typhoon CVEs
- Onsite Global Media: Flax Typhoon Hacking Tools Seized
- GBlock: Integrity Tech Flax Typhoon FishHub EBurst Seizure 2026
- Picus Security: CISA AA26-281A How Chinese Government-Linked Actors Steal Sensitive Data