Executive Summary
Analysis of recent telemetry reveals that infrastructure previously attributed to the PRC-linked actor Flax Typhoon (also known as Ethereal Panda) remains active, though it has been repurposed to target newer vulnerabilities. The activity is split between two distinct operational clusters: hands-on keyboard exploitation targeting XWiki instances and automated commodity botnet activity associated with the RedTail malware family.
Technically, the actors have expanded their repertoire beyond legacy CVEs to include recent flaws such as CVE-2025-24893 (XWiki) and CVE-2024-4577 (PHP-CGI). The hands-on cluster uses scripted tools to deploy reverse shells via Groovy payloads, while the botnet cluster utilizes a specialized user-agent, 'libredtail-http', to deliver shell script droppers that facilitate self-replication.
This evolution demonstrates the longevity of adversary infrastructure and the necessity of continuous monitoring. Organizations are at risk of sensitive data theft through both targeted exploitation and opportunistic botnet infections, particularly in sectors relying on exposed XWiki, Apache, or PHP-based applications.