Chinese hackers abuse geo-mapping tool for year-long persistence

**Chinese APT abused ArcGIS SOE for year-long stealthy access**: Researchers attribute a long-term intrusion to Flax Typhoon where attackers uploaded a malicious Java SOE to a public ArcGIS server to act as a REST-based web shell, then installed SoftEther VPN Bridge (calling back to 172.86.113.142) to persist, move laterally, dump credentials (SAM, LSA) and access internal systems—impacting municipalities, utilities and critical infrastructure operators.