Vulnerabilities · Threat Intelligence
FBI Seizes Domains Used by Flax Typhoon Hackers Targeting Critical Infrastructure
The FBI has seized seven domains linked to the Flax Typhoon hacking group, disrupting tools used to scan and attack critical infrastructure in the US and abroad. The operation targeted a botnet and tools used for large-scale vulnerability scanning and intrusions.
Ross GrantUpdated 3 min read
The short version
The FBI has taken control of seven websites used by a hacking group called Flax Typhoon. This group used these sites and a network of hacked devices to find weaknesses and break into important organisations like power companies and universities. The operation makes it harder for the hackers to control their attacks, but it does not remove any malware already installed on victims' systems.
By the numbers
- 7domains seized by the FBIBankInfoSecurity
- 1.2 million+infected devices in the botnet databaseThe Hacker News
- 385,000+US victim devices recorded as of June 2024The Hacker News
- 260,000+actively infected devices worldwide as of June 2024The Hacker News
- 20Taiwanese universities confirmed as FishHub victimsBankInfoSecurity
What happened?
The FBI seized seven domains allegedly used by the China-linked hacking group Flax Typhoon to scan, infiltrate, and steal data from US and international critical infrastructure. The operation targeted tools and a botnet used for large-scale attacks. No arrests have been announced.
FBI and DOJ Target Flax Typhoon’s Infrastructure
The FBI and Department of Justice have seized seven domains allegedly used by Flax Typhoon, a hacking group linked to China, to attack critical infrastructure in the United States and other countries. According to reports from The Hacker News (opens in a new tab) and BankInfoSecurity (opens in a new tab), the operation aimed to disrupt the group’s ability to scan for vulnerabilities, deliver malware, and steal sensitive files from targeted organisations.
Tools and Tactics: MicroScan, FishHub, and the Botnet
Court documents allege that Integrity Technology Group, a Beijing-based company with Chinese government contracts, operated two main hacking tools: MicroScan and FishHub. MicroScan is a Python-based web application containing over 1,300 scripts for penetration testing. It was used to scan internet-facing systems for vulnerabilities in widely-used software such as OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts. The tool was accessible via the seized domain c0cc[.]cc as recently as September 2026.
The group routed their scanning activity through a botnet built from thousands of compromised small office/home office (SOHO) and Internet of Things (IoT) devices. This botnet, known as Raptor Train, used a variant of the Mirai malware and was managed by an application called Sparrow. By sending scans through infected devices, the attackers hid their true location and made their activity harder to trace. A database found on a server linked to the group contained records for over 1.2 million infected devices, with more than 385,000 in the US as of June 2024. At that time, over 260,000 devices were actively infected worldwide.
FishHub, the second tool, was used for more targeted attacks. It enabled spear-phishing campaigns (emails crafted to trick specific targets) and allowed attackers to deliver additional malware, gain remote access, search for files, and exfiltrate data. Five of the seized domains were used to deliver these follow-on attacks, while another domain was used to maintain access via remote-access software.
Who Was Targeted?
The targets of Flax Typhoon’s operations were diverse and included a power company in South Carolina, airports in Japan and Poland, Taiwanese companies in the natural gas and power sectors, universities, and a multinational non-governmental organisation. The US Department of Justice confirmed that at least 20 Taiwanese universities were victims of FishHub-related activity. In some cases, the group compromised networks shortly after scanning them with MicroScan, suggesting a rapid move from reconnaissance to exploitation.
How the Seizure Was Carried Out
A federal magistrate judge authorised the domain seizures on 6 October 2026. Registries were ordered to lock the domains, redirect them to FBI-controlled servers, and display a seizure notice. The supporting affidavit alleges that the domains facilitated violations of the Computer Fraud and Abuse Act and were funded from outside the US. No arrests or criminal charges have been announced so far.
Ongoing Risks and Advice for Defenders
Authorities and international partners have warned that while seizing domains disrupts attacker infrastructure, it does not remove malware or remote-access tools already installed on victim networks. The FBI, CISA, NSA, and agencies from the UK, Australia, Canada, Japan, New Zealand, and Spain have jointly advised organisations to patch internet-facing systems, require multifactor authentication for webmail and VPNs, disable unused services, and monitor for signs of compromise. Defenders are also urged to review logs for scanning and exploitation attempts, and to investigate indicators of compromise dating back as far as 2016.
The US Treasury had previously sanctioned Integrity Technology Group in January 2025 for its role in these attacks. The disruption of Flax Typhoon’s infrastructure is the second major action against the group in two years, following the takedown of its botnet in September 2024.
Claimed vs confirmed
- Confirmed
Integrity Technology Group operated the botnet and tools for Flax Typhoon attacks.
Alleged in court documents and confirmed by FBI and DOJ statements as reported by The Hacker News and BankInfoSecurity.
- Confirmed
FishHub tool compromised 20 Taiwanese universities.
Confirmed by the Department of Justice and reported by BankInfoSecurity.
The impact
- Money
- The operation may reduce future costs from attacks, but no direct financial loss or fine is reported. Under US law, breached organisations may face regulatory scrutiny and potential penalties if customer data was exposed.
- Reputation
- The seizure demonstrates active government response, but affected organisations may still face reputational harm if intrusions are revealed.
- Customers
- Customers of targeted organisations could be at risk if their data was accessed. They should watch for notifications and monitor their accounts for unusual activity.
Why it matters
Critical infrastructure such as power companies, airports, and universities were targeted, putting sensitive data and essential services at risk. Disrupting attacker infrastructure helps protect these sectors, but organisations must remain vigilant and check for signs of compromise.
How does it work?
Flax Typhoon used a botnet of compromised devices and two main tools: MicroScan for scanning vulnerabilities and FishHub for spear-phishing and remote access. The botnet routed malicious traffic through infected devices to hide the attackers' location. Seizing the domains disrupted their command-and-control infrastructure.
Key points
- FBI seized seven domains used by Flax Typhoon to attack critical infrastructure.
- The group used a botnet and tools for large-scale vulnerability scanning and spear-phishing.
- Targets included power companies, airports, universities, and NGOs in several countries.
- Seizing domains disrupts attacker operations but does not remove malware from victims.
- Organisations should patch systems, use multifactor authentication, and monitor for compromise.
Sources
The Hacker News
Reference
BankInfoSecurity
Reference
- FBI Seizes Domains Used in Flax Typhoon Attacks (opens in a new tab)
bankinfosecurity.com
- FBI Seizes Domains Used in Flax Typhoon Attacks (opens in a new tab)
