Flax Typhoon

U.S. authorities said on Wednesday that Flax Typhoon was used to infiltrate networks by exploiting known vulnerabilities and would then use existing system tools to perform filching.
The bots bypassed traditional security solutions like antivirus and intrusion detection systems because these systems were designed to detect known “malware signatures” or unusual file activity.

Therefore, the state-sponsored actor, in this case, the PRC, would avoid dropping large or sophisticated malware packages as these would increase the likelihood of triggering these defenses by relying on these stealth techniques of using legitimate system tools. They would minimize the use of any detectable malware. Therefore, attackers would avoid detection by the standard signature-based systems. After gaining initial access, the attackers dump user credentials from memory or password stores, allowing them to elevate privileges and move laterally across the network, accessing more sensitive systems and data.

Story By Skeeter Wesinger

September 19, 2024