FBI Disrupts Flax Typhoon Tools Used to Target Critical Infrastructure
Summary
The FBI and Justice Department seized domains and disrupted tools linked to China-associated Flax Typhoon. The activity included a Mirai-based botnet, vulnerability scanning, phishing, and intrusions targeting organizations in critical sectors.
Key points
- The FBI and Justice Department disrupted domains and platforms allegedly used by Flax Typhoon to scan and, in some cases, infiltrate critical infrastructure.
- Court documents allege Integrity Technology Group operated a Mirai-variant IoT botnet managed through an application called Sparrow.
- A botnet database reportedly recorded more than 1.2 million infected devices by June 2024, including over 385,000 unique U.S. devices.
- The Microscan tool used more than 1,300 scripts to scan for vulnerabilities; the article says it was accessible as recently as September 2026.
- FishHub allegedly enabled spear-phishing, network exploitation, and follow-on payload delivery; 20 Taiwanese universities were identified as victims of related activity.
- Reported techniques included credential harvesting, Microsoft 365 account brute forcing, mailbox access, and installing SoftEther VPN clients for persistence.
- Agencies from the U.S. and six partner countries issued a joint advisory about Integrity Tech’s role in enabling malicious cyber activity.
Article Details
- Event Type
- The FBI and Department of Justice announced a disruption of tools associated with Flax Typhoon, including the seizure of domains and blocked access to platforms used for scanning and, in some cases, intrusions.
- Impact
- The article reports that a botnet database contained records for more than 1.2 million infected devices, including over 385,000 unique U.S. victim devices, as of June 5, 2024; more than 260,000 devices, including approximately 126,000 U.S. devices, were actively infected on that date. Reported targets and victims included U.S. and foreign critical infrastructure, airports, and Taiwanese universities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | c0cc[.]cc | Domain through which the MicroScan reconnaissance and vulnerability-scanning tool was accessible. |
| DOMAIN | w8510[.]com | Identified as a domain, including its subdomains, used by the botnet for command-and-control. |
| IPV4 | 198[.]13[.]53[.]226 | Original host of the MicroScan reconnaissance and vulnerability-scanning tool. |
| IPV4 | 202[.]182[.]109[.]151 | Server hosting a database of records for infected botnet devices. |
People
Brett LeathermanAssistant Director of the FBI's Cyber Division, quoted on Integrity Technology Group and the activity.Troy RivettiU.S. Attorney for the Western District of Pennsylvania, quoted on the activity.Xu ZeweiCo-defendant extradited to the U.S. from Italy in April 2026 to face charges related to alleged theft of COVID-19 research.Zhang YuChinese national charged in the U.S. in connection with the 2021 Microsoft Exchange Server attacks; the State Department announced a reward for information leading to his identification or location.
Threat Actors
Ethereal PandaName the article gives as another tracking name for Flax Typhoon.Flax TyphoonChina-linked advanced persistent threat group associated with the disrupted tools and activity. The article says it is also tracked as Ethereal Panda and RedJuliett.HafniumFormer name for Silk Typhoon, as stated in the article.Silk TyphoonMoniker used for activity connected in the article to Zhang Yu and the 2021 Microsoft Exchange Server attacks; the article says it was formerly known as Hafnium.
Malware
Products
Microsoft 365have been found to use EBurst, an open-source Python-based brute-force tool, to target accounts in Microsoft 365 Cloud environments, and gain unauthorized access to mailbox data using a command-line utility known asMicrosoft Exchange Serveror location of Zhang Yu, a Chinese national charged in the U.S. in connection with the 2021 Microsoft Exchange Server attacks.SoftEther VPNBesides installing SoftEther VPN software clients on victim devices for persistence, the threat actors have been found to use EBurst, an open-source Python-based brute-force tool, to target accounts in Microsoft 365
Tools
BBScanJuniper ScreenOS, Jenkins, and Apache Struts. The scanner is complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to finddirsearchScreenOS, Jenkins, and Apache Struts. The scanner is complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilitiesEBurstVPN software clients on victim devices for persistence, the threat actors have been found to use EBurst, an open-source Python-based brute-force tool, to target accounts in Microsoft 365 Cloud environments,FishHubA second Integrity Tech tool is FishHub, which allegedly enabled the exploitation of computer networks through spear-phishing attacks and the deployment of follow-on payloads. Confirmed victims of FishHub-relatedfscanJenkins, and Apache Struts. The scanner is complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities inksubdomainand Apache Struts. The scanner is complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities in networks andmasscanStruts. The scanner is complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities in networks and web-basedMicroScanThe botnet made use of a tool called Microscan to facilitate reconnaissance and computer vulnerability scanning, allowing the threat actors to identify targets of interest. The Python-based web tool, originally hostedNmapThe scanner is complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities in networks and web-basedoffice-cliCloud environments, and gain unauthorized access to mailbox data using a command-line utility known as office-cli.OneForAllis complemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities in networks and web-based applications.ShuiZecomplemented by open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities in networks and web-based applications.Sparrowand devices in the botnet. The botnet itself was controlled and managed by an application named Sparrow.WPScanby open-source tooling like BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan that are used to find vulnerabilities in networks and web-based applications.
Countries
ChinaThe U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.Japanadvisory issued by cybersecurity and intelligence agencies from the U.S., the U.K., Australia, Canada, Japan, New Zealand, and Spain has called out the for-profit company for enabling malicious cyber actors toPolandTaiwanUnited StatesThe U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.