FBI Disrupts Chinese Flax Typhoon Hacking Tools Used Against Critical Infrastructure
The FBI said it disrupted hacking infrastructure used by Flax Typhoon, a China-linked group accused of compromising critical infrastructure organizations worldwide, by seizing seven domains that supported two custom tools known as MicroScan and FishHub. BleepingComputer and The Hacker News both reported the action on October 8 and 9.
According to the reports, the seized domains had been used to scan networks for vulnerable, internet-facing devices and to help maintain access to systems the group had already compromised, including targets in critical infrastructure sectors. U.S. officials have previously linked Flax Typhoon to a broader pattern of Chinese state-linked intrusions into infrastructure operators.
The takedown coincided with the Cybersecurity and Infrastructure Security Agency adding five vulnerabilities exploited by Flax Typhoon to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies only until October 11 to patch the affected systems. The short deadline underscored how seriously officials were treating the group’s continued access to exploitable flaws even as the domain seizures proceeded.