Chinese state-linked hacking group targeting critical infrastructure and government networks, tied to Integrity Technology Group.
DOJ and FBI seized seven domains tied to Integrity Tech's Microscan and FishHub tools, the second action against the Flax Typhoon contractor. The company still had live scanning and phishing infrastructure to seize after the September 2024 botnet takedown.
Reality
CISA gave federal agencies until October 11 to fix five flaws China-linked Flax Typhoon has exploited, the oldest carrying 2015 CVE numbers. For other operators, each bug's preconditions decide which old servers need the patch first.
Perspective Coverage
3 publishersReality
US, UK and allied governments on October 8 described sanctioned Integrity Technology Group as a tool and infrastructure supplier that enabled Flax Typhoon. Its technique list centers on email theft and names the files and clients operators left on victim systems.
Reality
FBI and Justice Department investigators seized seven domains that China-linked Flax Typhoon used to scan and in some cases infiltrate critical infrastructure. The risk remains, and with no patch to install, exposed operators have to hunt the group's tradecraft themselves.
Reality
Integrity Technology Group, a government-linked Chinese firm, enables China-linked hackers to breach US and foreign networks, ten agencies said. The advisory treats the firm and its crews as one set of actors, so a single hunt can span sectors.
Perspective Coverage
14 publishersReality
The FBI and six other governments said on October 8 that hackers tied to Integrity Technology Group run a portal giving third parties access to stolen email. The firm, sanctioned by the US and UK, denies the accusations.
Reality
Justice says Chinese state operators laundered intrusions through infected routers and cameras in more than 130 countries since 2018. Source geography has been unreliable for years.
Perspective Coverage
7 publishersReality
Asus is the biggest name so far through the Conditional Approval process that the Defense and Homeland Security departments run. Applicants hand over a component-level supply chain report and a time-bound plan to build the router in the US.
Reality
Black Lotus Labs assesses the botnet as Chinese state work under Flax Typhoon, assembled from SOHO routers, NVRs, NAS boxes and IP cameras whose 17-day average lifespan makes the infrastructure disposable by design.
Reality