FBI Seizes Seven Domains to Disrupt China-Linked Flax Typhoon Cyber Operations

The U.S. Federal Bureau of Investigation and Department of Justice have disrupted infrastructure associated with Flax Typhoon, a China-linked cyber threat group accused of conducting reconnaissance and intrusions against critical infrastructure in the United States and other countries.

The operation involved seizing seven internet domains used to support malicious cyber activities. According to U.S. authorities, the infrastructure enabled threat actors to scan networks, identify vulnerabilities, and, in some cases, gain unauthorized access to targeted systems.

The action aims to disrupt tools and services that have supported cyber operations against government, business, and critical infrastructure targets.

Seven Domains Seized by U.S. Authorities

The FBI seized seven domains associated with the group’s cyber operations. The domains were used to host or provide access to infrastructure supporting reconnaissance, vulnerability scanning, and related activities.

The operation targeted the technical resources that helped threat actors identify potential victims and conduct intrusions.

Authorities say disrupting this infrastructure can make it more difficult for malicious operators to locate vulnerable systems and maintain their cyber campaigns.

Connections to Integrity Technology Group

Flax Typhoon, also tracked under names including Ethereal Panda and RedJuliett, has been associated with Integrity Technology Group, a Beijing-based company that reportedly contracts with the Chinese government.

U.S. authorities allege that the company developed and operated cyber infrastructure that enabled malicious actors to compromise devices and target networks.

The group was previously linked to the Raptor Train botnet, which consisted of thousands of compromised small-office, home-office, and Internet of Things devices.

A court-authorized operation disrupted that botnet in September 2024.

Millions of Devices Recorded in Botnet Infrastructure

Court documents describe a botnet that used a variant of Mirai malware and compromised routers, IoT products, and other internet-connected equipment.

A database associated with the infrastructure reportedly contained records for more than 1.2 million infected devices as of June 5, 2024, including more than 385,000 unique U.S. victim devices.

Authorities also reported that more than 260,000 devices were actively infected at that time, including approximately 126,000 devices in the United States.

The botnet used command-and-control infrastructure to communicate with compromised devices and manage their activities.

Reconnaissance Tools Used to Identify Vulnerabilities

Investigators identified a scanning tool known as MicroScan that was used to examine networks and web applications for security weaknesses.

The Python-based tool contained more than 1,300 penetration-testing scripts designed to identify vulnerabilities in a variety of technologies, including OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts.

MicroScan was supplemented by other tools used for network discovery, website enumeration, and vulnerability assessment.

Authorities said the infrastructure supported targeting activities involving a U.S. power company in South Carolina, a multinational nongovernmental organization, airports in Japan and Poland, Taiwanese energy-sector organizations, and two Taiwanese universities.

Additional Tool Enabled Network Exploitation

Another tool, known as FishHub, allegedly supported spear-phishing attacks and the delivery of additional malicious payloads.

Investigators identified 20 Taiwanese universities among the confirmed victims associated with FishHub-related activity.

According to the U.S. Justice Department, the malicious infrastructure enabled unauthorized remote access to victim networks and helped operators search for specific files and transfer them to servers under their control.

The broader activity also involved credential harvesting, attacks against cloud services, and attempts to access Microsoft 365 environments.

International Agencies Warn of Continued Threats

Cybersecurity and intelligence agencies from the United States, United Kingdom, Australia, Canada, Japan, New Zealand, and Spain issued a joint advisory concerning the activities associated with Integrity Technology Group.

The advisory described how commercial and contractor-linked infrastructure can help expand the reach of state-linked cyber operations.

U.S. authorities said disrupting such infrastructure is intended to make it harder for malicious actors to conduct reconnaissance, exploit vulnerabilities, and access sensitive information.

The seizure of the seven domains represents a disruption of identified operational resources, although it does not necessarily mean that every related threat actor or compromised device has been eliminated.

Conclusion

The FBI’s seizure of seven domains highlights continuing efforts to disrupt cyber infrastructure associated with Flax Typhoon and its alleged links to China-based technology services.

The investigation points to a broad operation involving botnets, vulnerability scanners, phishing tools, and compromised internet-connected devices.

Organizations operating critical infrastructure should strengthen network monitoring, secure exposed internet-facing systems, enforce multifactor authentication, and promptly address known vulnerabilities.

The operation also demonstrates the importance of international cooperation in identifying and disrupting cyber operations that cross national borders.