China-Backed Flax Typhoon APT Maintained Year-Long Access by Turning ArcGIS SOE into Web Shell Backdoor

ReliaQuest has disclosed that the China-backed APT group Flax Typhoon maintained year-long access to an ArcGIS system by turning a legitimate ArcGIS Java Server Object Extension into a covert web shell, protected by a hardcoded access key and embedded within backups to ensure persistence after recovery. According to ReliaQuest, the attackers repurposed the SOE to gate access and blend their activity with normal ArcGIS traffic, enabling long-term presence without triggering typical malware alerts.

The operation began with a compromised ArcGIS portal administrator account, followed by base64-encoded commands disguised as legitimate traffic to the portal server, enabling persistence and lateral movement. Investigators found hidden system directories, PowerShell commands via the ArcGIS API, and a renamed SoftEther VPN executable (bridge.exe) in System32 to provide a covert VPN bridge back to the attackers’ infrastructure.

The intrusion targeted IT administrator workstations and aimed to dump SAM and LSA secrets, with evidence of credential harvesting indicated by a file named pass.txt.lnk. ReliaQuest notes Flax Typhoon—also known as Ethereal Panda—has a history of long-term persistence, active since at least 2021, with assessments suggesting a 55–70% likelihood the group remains active in new networks.