flax typhoon2 articles
FBI Seizes Chinese Hacking Infrastructure as Seven Nations Warn of Ongoing PRC Espionage Campaign
The FBI seized seven web domains linked to Chinese security firm Integrity Technology Group, which allegedly provided hacking tools — including a vulnerability scanner and malware — used by Beijing-backed hackers known as Flax Typhoon to target critical infrastructure worldwide, including a South Carolina power company. A joint advisory from seven governments warned that these actors use botnets, malware, and various intrusion techniques to steal sensitive data from organisations globally, prompting CISA to add five new CVEs to its Known Exploited Vulnerabilities Catalog. Despite the partial dismantling of Flax Typhoon's 260,000-device botnet in 2024, Western governments and security researchers warn that Chinese state-sponsored hacking activity against critical infrastructure continues unabated.
China's Integrity Technology Group Ran a Stolen Email Portal for Third Parties, Say FBI and Six Allies
Hackers linked to Chinese cybersecurity firm Integrity Technology Group have been stealing emails from government agencies, healthcare systems, law enforcement, and religious institutions across multiple regions since at least 2021, according to a joint advisory from the FBI and six other countries. The group exploited known software vulnerabilities, used password-spraying tools, and deployed legitimate software like SoftEther VPN to maintain access, while also operating a web portal that gave third parties access to the stolen email content. The U.S. and UK have sanctioned Integrity Technology Group, and authorities are urging organizations to apply patches, enforce multifactor authentication, and monitor for signs of compromise.