Researchers at ReliaQuest documented a year-long intrusion attributed with moderate confidence to the Chinese APT group Flax Typhoon (aka Ethereal Panda), in which attackers weaponized a legitimate ArcGIS server component — a Java server object extension (SOE) — into a covert web shell, embedded it in system backups to survive remediation, and established a SoftEther VPN bridge for persistent command-and-control into the victim's internal network. ArcGIS confirmed this was the first documented case of a malicious SOE being deployed in this manner.
Initial Access: Compromised Portal Administrator Account
Working with Esri (ArcGIS developer), ReliaQuest determined that the attackers first compromised a portal administrator account — identified by an anomalous "leet" password inconsistent with normal administrative practice — and used it to deploy a malicious SOE to the public-facing ArcGIS server. The targeted environment used a common default configuration in which a public portal proxied commands to a private internal ArcGIS server via a Web Adapter. This architecture gave the attackers a reach into the internal network through a single public-facing compromise point. The attack vector is specific to self-hosted ArcGIS environments; ArcGIS Online (SaaS) is not affected, as it does not permit custom SOE installation.
Execution: Web Shell Gated by Hardcoded Key
The malicious SOE was repurposed to function as a web shell activated by appending a hardcoded key to HTTP GET requests. Initial execution was confirmed via a base64-encoded GET request to the JavaSimpleRESTSOE extension's getLayerCountByType operation, decoded to cmd.exe /c mkdir C:\Windows\System32\Bridge — creating a hidden staging directory within a trusted system path. All subsequent command execution followed the same pattern: encoded PowerShell commands routed through the same SOE extension, producing output the attackers could read to confirm success. The hardcoded key served a dual security function — preventing other attackers or curious administrators from discovering and tampering with the backdoor.
Persistence: SoftEther VPN Bridge Surviving Recovery
For durable persistence, the attackers uploaded a renamed SoftEther VPN executable as bridge.exe into C:\Windows\System32\ — a trusted path that reduces detection probability — alongside required configuration files, then created an auto-starting service named SysBridge. Repeated service restart attempts during setup reflect deliberate troubleshooting for system-privilege persistence across reboots and patches. The bridge.exe process then established outbound HTTPS connections on port 443 to an attacker-controlled IP (172.86.113[.]142), creating a SoftEther VPN bridge that extended the victim's internal network to the attacker's infrastructure — making attacker traffic appear as internal network activity. Domain analysis revealed incrementing SoftEther-hosted domains (e.g. <company>03.softether.net through <company>05.softether.net), indicating repeated prior C2 establishment attempts against the same or related targets.
The most operationally significant persistence mechanism was the malicious SOE's inclusion in the victim's own system backups. After initial remediation and patching, the attackers returned through the same backdoor — effectively turning the organization's recovery infrastructure into a guaranteed reinfection vector. Full remediation required rebuilding the entire server stack from scratch.
Credential Access and Lateral Movement
Post-network scanning across SSH, HTTPS, SMB, and RPC protocols on internal subnets, the attackers specifically targeted two workstations belonging to IT personnel — high-value credential sources. They attempted to enable RemoteRegistry and dump the Security Account Manager (SAM) database, security registry keys, and LSA secrets. A file named pass.txt.lnk written to disk indicated active credential harvesting, likely in preparation for broader Active Directory lateral movement.
Attribution and Defensive Implications
ReliaQuest attributes the intrusion with high confidence to Chinese APTs and moderate confidence to Flax Typhoon specifically, based on SoftEther VPN use (a Flax Typhoon hallmark), targeting consistent with the group's known sector and regional focus, observed activity times aligning with Chinese business hours (12AM–6PM UTC), and the group's defining characteristic of maintaining access for over 12 months before taking action. ReliaQuest assesses a 55–70% probability that Flax Typhoon is already active in additional networks or planning future operations, making proactive threat hunting for SOE anomalies, unusual service creation in System32, and outbound SoftEther VPN connections a priority for critical infrastructure operators.