CISA Adds Five Legacy CVEs to KEV After Flax Typhoon Operations Target Critical Infrastructure

CISA's KEV update follows a multi-nation advisory documenting Integrity Technology Group tooling used by Flax Typhoon to scan and exploit the five flaws. The actor chained ProFTPD improper access control, ONLYOFFICE path traversal, Strapi cleartext exposure, Apache Struts command injection, and BIND assertion issues with password spraying and VPN persistence implants. Email and credential exfiltration scripts completed the access chain into targeted networks. Procurement records and prior Mandiant reporting on Flax Typhoon show consistent reuse of decade-old CVEs rather than novel zero-days, indicating a deliberate focus on unpatched edge devices and OT-adjacent systems. The same pattern appears in Volt Typhoon activity logs released by Microsoft, where legacy remote access tools served as prepositioning footholds rather than immediate espionage vectors. Joint attribution statements from seven nations name Integrity Technology Group but supply no packet captures or infrastructure IOCs linking specific Chinese state entities. Independent telemetry from Shadowserver and Censys confirms scanning spikes from Chinese ASNs against the affected products weeks before CISA's listing, yet no public evidence ties the traffic directly to military units. Federal agencies must now either patch or isolate affected systems by the deadline. Continued monitoring of exposed ProFTPD and Struts instances on public internet scans will reveal whether the deadline produces measurable reduction in accessible targets or simply drives the activity deeper into supply-chain intermediaries.