US and Allies Seize Flax Typhoon Tools, Disrupt China-Linked Campaign
US agencies seized domains and blocked infrastructure used by the Beijing-based group to scan and intrude into critical systems.
Key points
- US and international partners disrupted digital tools linked to the Flax Typhoon campaign.
- The operations targeted US critical infrastructure through widespread vulnerability scanning.
- The FBI and Department of Justice seized seven domains associated with the threat actor.
The United States, in coordination with international partners, has seized digital tools and infrastructure associated with the Flax Typhoon cyber campaign. According to reports from The Record and The Hacker News, the operation disrupted capabilities used by the Beijing-based firm Integrity Tech to conduct widespread vulnerability scanning and intrusions.
The Federal Bureau of Investigation (FBI) and the Department of Justice (DoJ) announced the seizure of seven domains and the blocking of access to platforms utilized by the group. These tools were employed to scan and, in some instances, infiltrate US critical infrastructure. The Record notes that the coalition took down the specific digital assets that enabled the group’s persistent access and reconnaissance activities.
Context and Background
Flax Typhoon is identified as a China-linked advanced persistent threat (APT) group. The campaign has been characterized by its focus on probing networks for weaknesses before attempting deeper access. The disrupted infrastructure allowed the group to maintain a foothold in targeted environments, facilitating ongoing surveillance and data exfiltration efforts.
The involvement of Integrity Tech, a Beijing-based entity, links the technical infrastructure directly to the threat actor’s operational base. By seizing the domains and blocking the platforms, US agencies aimed to degrade the group’s ability to launch further attacks from these specific command-and-control nodes. The Record reports that the seizure targeted the mechanisms that allowed for "widespread vulnerability scanning," which served as the initial vector for many of the intrusions.
Who Is Affected
US critical infrastructure sectors were the primary targets of the Flax Typhoon campaign. The Hacker News reports that the seized tools were used to infiltrate these high-value targets. Organizations within energy, telecommunications, and other essential services that may have been exposed to the group’s scanning activities are advised to review their network logs for indicators of compromise associated with the seized domains.
While the immediate disruption of the tools limits the group’s ability to use these specific channels, the broader campaign may still pose risks if alternative infrastructure remains active. Security teams should remain vigilant for lateral movement or persistence mechanisms that may have been established prior to the seizure.
What should you do?
Security professionals should monitor for any activity originating from or connecting to the seven seized domains mentioned in the FBI and DoJ announcements. Reviewing firewall logs and endpoint detection data for connections to these indicators can help identify if an organization was previously compromised. Additionally, organizations should verify that their vulnerability management programs are up to date, as the group relied on scanning for known weaknesses to gain initial access.
What to do and how to stay safe: Flax Typhoon
- Search network logs and firewall records for connections to the seven domains seized by the FBI and DoJ.
- Review endpoint detection and response alerts for signs of vulnerability scanning or unauthorized access attempts.
- Ensure all critical infrastructure systems are patched against known vulnerabilities to reduce the attack surface.
- Monitor for unusual outbound traffic that may indicate the use of alternative command-and-control channels.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who conducted the seizure of Flax Typhoon tools?
The US Federal Bureau of Investigation and the Department of Justice, in coordination with international partners, conducted the operation.
What organization is linked to the Flax Typhoon campaign?
The campaign is linked to Integrity Tech, a Beijing-based firm, according to reports from The Record.
What type of infrastructure was targeted?
The group targeted US critical infrastructure, using tools to scan for vulnerabilities and in some cases intrude into these systems.
