---
title: "Discussion on \"Ten Doors In: How Flax Typhoon Actors Steal Email from Exchange and M365\" | Hashnode"
description: "Discussion on \"Ten Doors In: How Flax Typhoon Actors Steal Email from Exchange and M365\". Flax Typhoon used EBurst to spray 10 Exchange interfaces and Curlc4 to steal mail via EWS API. IOCs, CVEs, and detection guidance for defenders."
url: "https://hashnode.com/posts/flax-typhoon-eburst-exchange-curlc4-2026/6adc33464c0bbdadb35cce86"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Ten Doors In: How Flax Typhoon Actors Steal Email from Exchange and M365](https://404-founders.com/blog/flax-typhoon-eburst-exchange-curlc4-2026?utm_source=hashnode&utm_medium=feed)

Flax Typhoon used EBurst to spray 10 Exchange interfaces and Curlc4 to steal mail via EWS API. IOCs, CVEs, and detection guidance for defenders.

Oct 11 · 9 min read · 404-founders.com  
Updated Oct 31  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)
-   [#microsoft](https://hashnode.com/tag/microsoft)
-   [#exchange](https://hashnode.com/tag/exchange)

## Written by

[404 Founders](https://hashnode.com/@404-founders)

@404-founders · Bosnia and Herzegovina, Estonia

  
[View profile](https://hashnode.com/@404-founders)

Error-proof Cyber Solutions

Securing the digital frontier. Error-proof cyber solutions.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.