FBI, DoJ disrupt China-linked Flax Typhoon scans of US critical infrastructure

The US Federal Bureau of Investigation and the Department of Justice have announced the disruption of malicious digital tools used by the advanced persistent threat group known as Flax Typhoon. According to The Record, this international coalition seized infrastructure operated by Beijing-based Integrity Tech. The action blocked access to platforms that the group used for widespread vulnerability scanning and, in some cases, to intrude into US critical infrastructure.

In plain English

Flax Typhoon is a cyber threat group with links to China. For some time, this group has been using specific online tools to look for weaknesses in computer systems, particularly those belonging to critical infrastructure providers in the United States. Think of these tools as digital keys or maps that help attackers find unlocked doors. The US government, working with allies, has now taken control of the domains and servers that powered these tools. This means the group can no longer use these specific channels to scan for vulnerabilities or launch intrusions. The goal is to stop the group from easily finding and entering sensitive networks.

The background

According to The Hacker News, the FBI and DoJ specifically seized seven domains associated with the campaign. These domains served as the backbone for the tools that allowed Flax Typhoon to operate. The Record notes that the infrastructure belonged to Integrity Tech, a firm based in Beijing.

The group’s activities were not limited to just looking for weaknesses; in some instances, they successfully infiltrated systems. The focus of their efforts has been on critical infrastructure, which includes sectors essential to the economy and national security, such as energy, transportation, or water systems. The disruption of these tools is a direct response to the threat posed by these ongoing scans and breaches.

What changes now

For organizations in critical infrastructure sectors, the immediate landscape has shifted. The specific tools Flax Typhoon relied upon are no longer accessible. This reduces the ease with which the group can conduct large-scale scans against US targets. However, the disruption of these domains does not mean the threat is entirely gone. Attackers often adapt by moving to new infrastructure or using different methods. Security teams should remain vigilant and continue to monitor for signs of compromise. The seizure serves as a significant setback for the group’s operational capabilities but does not eliminate the underlying risk of targeted attacks.

Background: Vulnerability scanning

Vulnerability scanning in cyber security involves automated tools that probe systems for known weaknesses. These scanners compare your software versions and configurations against databases of public exploits. They provide a baseline of security hygiene but fail to identify complex application logic errors or novel attack vectors that lack a known signature.

Read the full guide: Vulnerability Scanning in Cyber Security: What It Misses and How to Fix It

What to do and how to stay safe: Flax Typhoon

• Review logs for any historical connections to the seized domains or infrastructure associated with Flax Typhoon.
• Monitor network traffic for unusual scanning activity or attempts to access systems from new, unknown sources.
• Ensure that all critical infrastructure systems are patched and configured according to best security practices.
• Once the vendor provides an update, apply it immediately to close any known vulnerabilities that may have been exploited.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is behind the Flax Typhoon campaign?

Flax Typhoon is a China-linked advanced persistent threat group, and the seized infrastructure was operated by Beijing-based Integrity Tech.

What did the US government seize?

The FBI and DoJ seized seven domains and blocked access to platforms used for scanning and intruding into US critical infrastructure.

Was Flax Typhoon successful in breaking into systems?

Yes, according to reports, the tools allowed for widespread vulnerability scanning and, in some cases, successful intrusions.