Key points
- The FBI and Department of Justice seized seven domains associated with the Flax Typhoon threat group.
- The infrastructure belonged to Integrity Tech, a Beijing-based firm linked to widespread vulnerability scanning.
- The tools were used to scan and, in some cases, intrude into US critical infrastructure systems.
The short version
- US federal agencies have seized digital tools and domains used by the China-linked Flax Typhoon group.
- The seized infrastructure was operated by Integrity Tech, a Beijing-based technology firm.
- The campaign involved scanning for vulnerabilities and, in some instances, gaining unauthorized access to critical infrastructure.
The details
The US Federal Bureau of Investigation and the Department of Justice announced the disruption of malicious infrastructure used by the advanced persistent threat group known as Flax Typhoon, according to reports from The Hacker News. The agencies seized several domains and blocked access to platforms that had been used to scan for weaknesses and, in some cases, infiltrate US critical infrastructure.
This action was part of a broader international effort. The Record reported that a coalition of nations took down digital tools and infrastructure belonging to Integrity Tech, a Beijing-based firm. The group is identified as being behind the Flax Typhoon campaign, which utilized these assets to conduct widespread vulnerability scanning. In some cases, these scans led to actual intrusions into target systems.
The seized domains served as command and control or delivery mechanisms for the scanning tools. By blocking access to these platforms, the agencies aimed to halt the ongoing reconnaissance and intrusion activities targeting essential services and infrastructure in the United States.
The context
Flax Typhoon is identified as a China-linked advanced persistent threat group. The group’s operations focus on scanning for vulnerabilities in critical infrastructure, which can serve as a precursor to more severe attacks or data exfiltration. The involvement of Integrity Tech suggests a direct link between a specific commercial or state-adjacent entity and the operational tools used in these campaigns.
The seizure of domains is a common tactic in disrupting cyber campaigns, as it removes the immediate ability for attackers to deploy scanning tools or receive data from compromised systems. However, threat groups often maintain backup infrastructure, so the disruption may be temporary or partial. The international coalition aspect indicates that this activity was viewed as a significant threat requiring coordinated legal and technical action across borders.
What to watch
Organizations should monitor for any new domains or infrastructure linked to Integrity Tech or Flax Typhoon, as attackers may migrate to new locations. Security teams should review logs for any historical connections to the seized domains, as these may indicate prior scanning or intrusion attempts. Additionally, watch for any public advisories from the FBI or DoJ regarding further seizures or new tactics employed by this group.
What to do and how to stay safe: Flax Typhoon
- Review firewall logs and network traffic data for any historical connections to the seized domains or IP addresses associated with Integrity Tech.
- Ensure that all public-facing systems are patched and that vulnerability scanners are not inadvertently exposing internal network topology.
- Monitor authentication logs for unusual activity that may indicate post-scanning intrusion attempts, such as failed login spikes or access from new geographic regions.
- Verify that incident response plans include procedures for identifying and isolating systems that have communicated with known malicious infrastructure.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What organization was behind the Flax Typhoon scanning tools?
The tools were linked to Integrity Tech, a Beijing-based firm, according to The Record.
Which US agencies seized the domains?
The Federal Bureau of Investigation and the Department of Justice announced the seizure, according to The Hacker News.
What was the primary use of the seized infrastructure?
The infrastructure was used for widespread vulnerability scanning and, in some cases, intrusions into US critical infrastructure.
