The FBI and the US Department of Justice have disrupted hacking tools used by Flax Typhoon, a China-linked state-sponsored group, seizing seven domains and blocking access to platforms that were used to scan and, in some cases, break into US critical infrastructure. The action, reported by The Hacker News on October 9, came alongside a joint advisory from seven countries and new orders from the US Cybersecurity and Infrastructure Security Agency (CISA).
Who is behind Flax Typhoon
Flax Typhoon, also tracked as Ethereal Panda and RedJuliett, is what security researchers call an advanced persistent threat (APT): a well-resourced group that quietly gains access to networks and tries to stay inside for long periods, usually for espionage. US officials link it to Integrity Technology Group, a Beijing-based company that contracts with the Chinese government. The same company was previously tied to the Raptor Train botnet, a network of hijacked internet-connected devices that was taken down in a court-authorized operation in September 2024.
What was disrupted
Authorities seized seven domains: c0cc[.]cc, 98aiblog[.]com, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net. Several of them imitate familiar brands, a common trick to make malicious traffic look legitimate.
Two tools were singled out:
- MicroScan, a Python-based reconnaissance and scanning tool believed to have been in use since 2017. It contains more than 1,300 penetration testing scripts that check for known vulnerabilities in products such as OpenSSL, Oracle WebLogic, Jenkins, Apache Struts and WordPress. According to an FBI affidavit cited by The Hacker News, it was reachable through c0cc[.]cc as recently as September 9, 2026.
- FishHub, a platform for spear-phishing (targeted, personalized phishing emails) and for delivering follow-on malware. Confirmed victims include 20 Taiwanese universities.
Targets named in the reporting include a US power company in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, and Taiwanese companies in the natural gas and power sectors.
Seven countries issue a joint warning
Agencies from the United States, United Kingdom, Australia, Canada, Japan, New Zealand and Spain published a joint advisory (AA26-281A) describing Integrity Technology Group as a for-profit company enabling malicious actors worldwide. The advisory describes attacks that combined scanning tools, cross-site scripting to harvest credentials, password spraying against Microsoft Exchange servers, VPN software installed for persistence, and scripts that exfiltrate emails and credentials.
“Chinese government-affiliated actors continue to position themselves within critical infrastructure networks,” said Chris Butera, CISA’s Acting Executive Assistant Director for Cybersecurity.
Five old flaws, one short deadline
CISA also added five vulnerabilities exploited by Flax Typhoon to its Known Exploited Vulnerabilities (KEV) catalog, the official US list of bugs confirmed to be used in real attacks. Federal agencies were given until October 11 to patch or stop using the affected software. Several of these flaws are close to a decade old, which shows how long unpatched systems can remain useful to attackers:
- CVE-2015-3306 (CVSS 10.0), ProFTPD: lets remote attackers read and write arbitrary files.
- CVE-2021-3199 (CVSS 9.8), ONLYOFFICE Docs: a path traversal flaw that could allow remote code execution.
- CVE-2023-22894 (CVSS 7.2), Strapi: sensitive user details exposed to anyone with admin panel access.
- CVE-2016-3081 (CVSS 8.1), Apache Struts: command injection when Dynamic Method Invocation is enabled.
- CVE-2015-5477 (CVSS 7.5), ISC BIND: a crafted query can crash the DNS server.
Flax Typhoon is one of several China-linked groups active against network infrastructure. Last month we covered the Fire Ant group hijacking Cisco routers, and CISA’s addition of seven actively exploited flaws to the KEV catalog.
Sources
- The Hacker News: FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions (October 9, 2026)
- The Hacker News: Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies (October 9, 2026)
- The Record from Recorded Future News: International coalition seizes tools used by cyber firm behind Flax Typhoon (October 8, 2026)
