Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year

Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year, according to ReliaQuest. The group, Flax Typhoon (also tracked as Ethereal Panda and RedJuliett), is alleged by ReliaQuest to have modified a geo-mapping application's Java server object extension into a functioning web shell, gating access with a hardcoded key and embedding it in system backups to achieve deep, long-term persistence.

The attackers reportedly used a public-facing ArcGIS portal administrator account to deploy a malicious SOE and activated it via a JavaSimpleRESTSOE extension, making the activity hard to spot. They deployed a web shell to run network discovery, and established a covert VPN channel by uploading a renamed SoftEther VPN executable to the System32 folder and creating a SysBridge service that starts on reboot, with outbound HTTPS connections to an attacker-controlled IP on port 443.

The campaign is said to have targeted two IT workstations to obtain credentials and deepen their foothold, with access to an administrative account enabling password resets, according to researchers. It’s noted as a warning about weaponising trusted tools and the need to recognise how legitimate processes can be manipulated, according to the researchers. According to the U.S. government, Flax Typhoon is assessed to be a Beijing-based, publicly-traded company known as Integrity Technology Group.