China's Flax Typhoon Turns Geo-Mapping Server into a Backdoor

Chinese APT group Flax Typhoon compromised a public-facing ArcGIS server and turned a geospatial mapping component into a backdoor, gaining access for more than a year by modifying ArcGIS’ Java server object extension to create a Web shell. Researchers described the attack chain as unusually clever, with the threat actors exploiting a portal administrator account to link a public portal to a private internal server, and establishing a hidden workspace with a hardcoded key.

The persistence was reinforced by ensuring the compromised component remained in backups, effectively guaranteeing reinfection after recovery. Reliaquest worked with the customer organisation and Esri to evict the attackers, rebuild the server stack, and deploy detections; the article also notes that ArcGIS is not unique in facing such tactics and stresses the need for robust behavioural analytics alongside signatures.

The piece mentions a 2024 breach disclosed by the Cybersecurity and Infrastructure Security Agency via GeoServer, and it urges treating all public-facing applications as high-risk assets, with strong credential hygiene and multifactor authentication. According to ArcGIS documentation, the public portal serves as a proxy forwarding commands to the internal server through a Web adapter.