Flax Typhoon APT exploited ArcGIS server for over a year as a backdoor

China-linked APT group Flax Typhoon compromised an ArcGIS system for over a year, turning a legitimate ArcGIS Server extension into a web shell and using it as a backdoor for hands-on-keyboard activity, credential harvesting, and lateral movement.

ReliaQuest and U.S. officials attribute the campaign to Integrity Technology Group, a Beijing-based company tied to state-sponsored cyber activity, and researchers note the attackers persisted by embedding a hidden web shell in a geo-mapping application’s SOE and gating access with a hardcoded key. The attackers created a secret workspace by making a folder called “Bridge” inside the Windows system directory, then executed PowerShell commands through encoded web traffic to remain hidden.

They established long-term access by uploading a renamed VPN program (“bridge.exe”) into the system folder and creating a fake Windows service named “SysBridge” that started automatically, enabling reconnection after restarts or updates. They used a fake VPN tool to tunnel encrypted traffic to their server, and targeted two IT workstations while attempting to enable RemoteRegistry to dump SAM, security keys and LSA secrets, leaving a pass.txt.lnk file as a sign of ongoing credential collection.

According to ReliaQuest, the attack demonstrates how trusted applications can be weaponised and highlights the need to treat public-facing tools like ArcGIS as high-risk assets, moving beyond IOC-based detection. Flax Typhoon has been active since mid-2021, with a focus on government, education, critical manufacturing, and IT sectors in Taiwan, and has been known to utilise tools such as China Chopper, Metasploit, Juicy Potato, Mimikatz and SoftEther VPN.