BRONZE FLAXEN

BRONZE FLAXEN is a threat group operating out of China, likely at the direction of the state. The group has been operating since at least 2021. BRONZE FLAXEN has compromised computer networks in North America, Europe, Africa, and across Asia, with a particular focus on Taiwan. BRONZE FLAXEN exploits publicly known vulnerabilities to gain initial access to victim computers and then uses legitimate remote access software (e.g. SoftEther VPN) to maintain persistent control over their network. BRONZE FLAXEN has targeted victims within a wide range of industries. In January 2025 the US Office of Foreign Assets Control (OFAC) sanctioned Integrity Technology Group,
a Beijing-based cybersecurity company, and specifically linked it to BRONZE FLAXEN activity.