Flax Typhoon’s Botnet Actively Exploiting 66 Vulnerabilities In Various Devices

The Five Eyes agencies recently released a joint cybersecurity advisory detailing a new botnet, Flax Typhoon, linked to Chinese state-sponsored actors.

The advisory highlights the actors’ use of compromised routers and IoT devices to establish a vast botnet capable of various malicious activities. 

The advisory provides technical indicators of compromise, exploited vulnerabilities, and the geographical distribution of impacted devices, which is crucial for organizations to identify and mitigate potential threats from this ongoing campaign.

Through the active exploitation of 66 vulnerabilities, the Flax Typhoon Botnet primarily targets routers, Internet of Things devices, and applications accessible via the web. The majority of infected devices are located in the United States. 

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Registration

VulnCheck KEV has been updated to include all 66 CVEs. In contrast, CISA KEV currently includes only 27, highlighting the urgent need for organizations to patch their systems promptly to mitigate the risks posed by this botnet.

The most affected vendors include Apache, Cisco, Zyxel, QNAP, Fortinet, Draytek, WordPress, Telesquare, Ivanti, IBM, F5, Contec, and Chamilo, which pose a significant risk to organizations using these technologies. 

Patching and mitigation efforts must be given a high priority to protect against the possibility of botnet attacks and data breaches.

The Flax Typhoon botnet has been found to target a wide range of countries, with the United States being the primary focus, accounting for nearly half of all infected devices. 

Other notable targets include Vietnam and Germany, suggesting a significant presence in North America, Europe, and Asia. The botnet appears to be actively targeting critical infrastructure in these regions, posing a potential threat to their operations.

It exploits 66 vulnerabilities, 41 of which were already known to VulnCheck. While only 27 of these are currently listed in CISA’s KEV catalog, it has now updated its own KEV to include all 66. 

Before the advisory, they had strong coverage, identifying 47 vulnerabilities as known exploited or weaponized, 11 as having proof-of-concept exploit code, and the remaining eight as having no known exploit evidence.

The FBI suggests several preventive measures to protect against botnets like Flax Typhoon, which include disabling unnecessary services and ports, segmenting networks to limit the spread of infections, closely monitoring network traffic for unusual activity, keeping devices up-to-date with patches and updates, using strong, unique passwords, regularly rebooting devices, and replacing outdated equipment. 

If organizations implement these security practices, they can significantly lessen their susceptibility to botnet attacks.

Analyse AnySuspicious Links Using ANY.RUN's New Safe Browsing Tool: Try It for Free