Tuesday, May 6, 2025
HomeBotnetFlax Typhoon's Botnet Actively Exploiting 66 Vulnerabilities In Various Devices

Flax Typhoon’s Botnet Actively Exploiting 66 Vulnerabilities In Various Devices

Published on

SIEM as a Service

Follow Us on Google News

The Five Eyes agencies recently released a joint cybersecurity advisory detailing a new botnet, Flax Typhoon, linked to Chinese state-sponsored actors.

The advisory highlights the actors’ use of compromised routers and IoT devices to establish a vast botnet capable of various malicious activities. 

The advisory provides technical indicators of compromise, exploited vulnerabilities, and the geographical distribution of impacted devices, which is crucial for organizations to identify and mitigate potential threats from this ongoing campaign.

- Advertisement - Google News

Through the active exploitation of 66 vulnerabilities, the Flax Typhoon Botnet primarily targets routers, Internet of Things devices, and applications accessible via the web. The majority of infected devices are located in the United States. 

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Registration

VulnCheck KEV has been updated to include all 66 CVEs. In contrast, CISA KEV currently includes only 27, highlighting the urgent need for organizations to patch their systems promptly to mitigate the risks posed by this botnet.

Technologies Targeted by Flax Typhoon Botnet
Technologies Targeted by Flax Typhoon Botnet

The most affected vendors include Apache, Cisco, Zyxel, QNAP, Fortinet, Draytek, WordPress, Telesquare, Ivanti, IBM, F5, Contec, and Chamilo, which pose a significant risk to organizations using these technologies. 

Patching and mitigation efforts must be given a high priority to protect against the possibility of botnet attacks and data breaches.

The Flax Typhoon botnet has been found to target a wide range of countries, with the United States being the primary focus, accounting for nearly half of all infected devices. 

Other notable targets include Vietnam and Germany, suggesting a significant presence in North America, Europe, and Asia. The botnet appears to be actively targeting critical infrastructure in these regions, posing a potential threat to their operations.

It exploits 66 vulnerabilities, 41 of which were already known to VulnCheck. While only 27 of these are currently listed in CISA’s KEV catalog, it has now updated its own KEV to include all 66. 

Before the advisory, they had strong coverage, identifying 47 vulnerabilities as known exploited or weaponized, 11 as having proof-of-concept exploit code, and the remaining eight as having no known exploit evidence.

The FBI suggests several preventive measures to protect against botnets like Flax Typhoon, which include disabling unnecessary services and ports, segmenting networks to limit the spread of infections, closely monitoring network traffic for unusual activity, keeping devices up-to-date with patches and updates, using strong, unique passwords, regularly rebooting devices, and replacing outdated equipment. 

If organizations implement these security practices, they can significantly lessen their susceptibility to botnet attacks.

Analyse AnySuspicious Links Using ANY.RUN's New Safe Browsing Tool: Try It for Free

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...