RedJuliett Cyber Espionage Campaign Hits 75 Taiwanese Organizations

Recorded Future's Insikt Group attributes a cyber espionage campaign to a likely China-linked APT cluster called RedJuliett (aka Flax Typhoon / Ethereal Panda) that targeted government, academic, technology, and diplomatic organizations in Taiwan and other countries from Nov 2023 to Apr 2024. The actor focused on internet-facing appliances for initial access (firewalls, load balancers, VPNs), used SQL injection and directory traversal against web/SQL apps, leveraged SoftEther for outbound tunneling, deployed web shells (China Chopper, AntSword, Godzilla) for persistence, and exploited vulnerabilities including Dirty Cow; approximately 24 organizations were observed communicating with the actor's infrastructure and at least 75 Taiwanese entities were targeted for reconnaissance and follow-on exploitation.