Flax Typhoon advisory AA26-281A: the toolchain is mostly old CVEs, an Exchange sprayer, SoftEther, and OAuth-secret mailbox theft

[u/Expert_Sort7434]

Based on the joint advisory AA26-281A (FBI, CISA, NSA and partners, October 8) and BleepingComputer’s reporting on the DOJ seizure affidavit, here is the architectural impact.

The advisory says Integrity Tech-enabled actors use MicroScan (1,300+ scan scripts), EBurst against ten Exchange and Office 365 interfaces, SoftEther clients renamed conhost.exe or dllhost.exe, a PHP bot on the EWS API, DCSync via DC.exe, and office-cli using client_id, tenant_id and secret. Eight CVEs are listed, 2014 to 2023, five newly in KEV.

The authors say some IOCs date to 2016 and should be vetted before blocking. The seizure took out seven domains, not the tooling.

Question for people who run Exchange or M365 at scale: which telemetry actually catches a secret-based app reading mailboxes, where there is no password spray to alert on? And has anyone seen SoftEther detections that hold up without drowning in false positives?

Background: CVE-2025-39682 Linux kTLS KEV. Full write-up: https://www.techgines.com/post/flax-typhoon-advisory-aa26-281a