Critical Infra Scanners Disrupted as US Seizes China-Linked Domains

The Federal Bureau of Investigation and the Department of Justice have announced the seizure of digital infrastructure used by the China-linked advanced persistent threat group known as Flax Typhoon. According to The Record, an international coalition took down tools and platforms maintained by Beijing-based Integrity Tech. These assets facilitated widespread vulnerability scanning and, in some instances, direct intrusions into US critical infrastructure.

What infrastructure was seized?

The agencies seized seven specific domains that served as command and control or scanning platforms for the campaign, according to The Hacker News. By blocking access to these domains, the FBI and DoJ disrupted the group’s ability to launch further scans against US targets. The operation represents a coordinated effort to dismantle the technical foundation of the Flax Typhoon campaign before additional intrusions could occur.

Who is behind the operation?

The threat actor is identified as Flax Typhoon, a group linked to China. The infrastructure utilized for these operations was attributed to Integrity Tech, a cybersecurity firm based in Beijing. According to The Record, this firm provided the digital tools that allowed for the widespread scanning and subsequent intrusions. The attribution suggests a state-linked or state-sponsored origin for the activity, consistent with previous intelligence on the group’s targets and methods.

Which sectors are affected?

The primary targets of the Flax Typhoon campaign are US critical infrastructure providers. The seized tools were specifically used to scan these sectors for vulnerabilities. In some cases, the scanning activity escalated into successful intrusions. While the source material does not list specific companies or sectors beyond the general category of critical infrastructure, the focus indicates that energy, utilities, and industrial control systems remain at high risk for this group.

What is the current status of the threat?

The disruption of the seven domains is a significant tactical blow to Flax Typhoon’s operational capabilities. However, threat groups often maintain redundant infrastructure or shift to new domains when existing ones are seized. The seizure prevents immediate access to these specific platforms, but it does not eliminate the group’s intent or capability to develop new tools. Security teams should assume that the threat actor may pivot to alternative infrastructure in the near future.

Background: Vulnerability scanning

Vulnerability scanning automates the discovery of known security weaknesses by probing systems against databases of signatures. It operates in stages: reconnaissance, fingerprinting, active testing, and reporting. The process reveals configuration errors and unpatched software but misses logic flaws, zero-day exploits, and business logic vulnerabilities that require human context to identify.

Read the full guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

What to do and how to stay safe: Flax Typhoon

• Review external-facing assets for signs of scanning activity originating from IP addresses associated with known threat actor infrastructure.
• Audit domain registration records and DNS logs to ensure no unauthorized domains are resolving to your internal networks.
• Monitor network traffic for unusual outbound connections that may indicate compromised hosts attempting to communicate with seized or similar domains.
• Update intrusion detection signatures to flag traffic patterns consistent with the scanning methods used by Flax Typhoon, even if the specific domains have been taken down.

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which US agencies were involved in the seizure?

The Federal Bureau of Investigation (FBI) and the Department of Justice (DoJ) led the operation, according to The Hacker News.

How many domains were seized?

The agencies seized seven domains linked to the Flax Typhoon campaign, according to The Hacker News.

Who owns the seized infrastructure?

The infrastructure was linked to Beijing-based Integrity Tech, according to The Record.