FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
Summary: The FBI and DoJ announced the seizure of domains and blocking of platforms used by Flax Typhoon, a China-linked APT tied to Beijing-based Integrity Technology Group, to scan and in some cases infiltrate U.S. critical infrastructure. Court documents allege Integrity Tech ran an IoT botnet using a Mirai malware variant, with a database holding records for more than 1.2 million infected devices as of June 5, 2024, including over 385,000 unique U.S. victim devices, and its Microscan tool carried over 1,300 penetration testing scripts.
What you should know: More than 260,000 devices, roughly 126,000 of them in the U.S., were actively infected as of June 5, 2024, and the same tooling reached a U.S. power company in South Carolina, Japanese and Polish airports, and Taiwanese gas and power operators. The FBI's Brett Leatherman framed the model plainly: the PRC relies on contractor companies like Integrity Tech to expand the reach of its cyber activity.
Read the original at The Hacker News ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026