Chinese Hackers Use Geo-Mapping Tool for Year-Long Persistence

The China-backed advanced persistent threat group Flax Typhoon maintained year-long access to an ArcGIS system by turning trusted software into a persistent backdoor, an attack so unique it prompted the vendor to update its documentation. The attackers repurposed a legitimate Java server object extension into a web shell, gated access with a hardcoded key, and embedded it in backups to evade detection.

The backdoor enabled hands-on-keyboard activity, facilitating command execution, lateral movement, and credential harvesting across multiple hosts, as attackers abused the same web shell to run encoded PowerShell commands routed through the JavaSimpleRESTSOE extension and the getLayerCountByType operation. ArcGIS, used to visualise and manage spatial data for critical functions, was targeted to access interconnected systems, and the attackers compromised a portal administrator account to deploy a malicious SOE.

Security researchers say the group maintains persistence often exceeding twelve months and relies on repurposing legitimate tools rather than deploying new malware, a tactic that challenges traditional indicators of compromise.