https://www.theregister.com/2025/10/14/chinese_hackers_arcgis_backdoor/
Whomever the entity was that had their installation compromised violated a very standard rule of modern cyber security hygiene - NEVER, EVER, EVER allow an administrative interface to be exposed to the Internet.
Administrative access needs to be behind a VPN connection or at least a solid Multi Factor Authentication (MFA) setup for login. Both VPN + MFA is the preferred armor to your kingdom for any administrative credentials.
Tom
Please see the blog here on the ArcGIS Trust site: https://trust.arcgis.com/en/https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/understanding-arcgis-server-soe-compromise
Relevant statement:"Flax Typhoon leveraged valid credentials – reportedly a portal administrator account – to deploy the malicious extension."Seems less of a 'backdoor', as the title implies, and more of a compromised admin account.
Signed in members can post, follow updates, and more. New here? Register a free account.
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.
