FBI and Allies Seize Flax Typhoon Domains Tied to Beijing Firm

The FBI has seized seven domains that Flax Typhoon, a Chinese state-sponsored group, used to run two tools called MicroScan and FishHub, according to BleepingComputer. Both tools were used in attacks that breached critical infrastructure. The Record reports that the United States and other nations also took down infrastructure belonging to Integrity Tech, a Beijing-based company, which the coalition says enabled widespread vulnerability scanning and, in some cases, intrusions.

Kai Tanner's Cyber Intel Desk has the full account, and the detail worth noticing is the name. Governments usually attribute attacks to a group with a codename. Here the coalition has pointed at a company, and the thing it is said to have run is vulnerability scanning, which in most settings is a product category sold to defenders. The CISA advisory, aa26-281a, describes the method in its own title: automated and hands-on tools, blended. The scanner finds the door, and a person walks through it. Tanner also covers a separate FBI notice, reported by The Hacker News, about hackers tied to a Chinese cybersecurity company who stole email from government bodies, law enforcement, healthcare systems and religious institutions in Southeast Asia, and ran a portal selling access to it.

The seizure matters for what it cuts and what it leaves. Taking seven domains severs the scanner's reporting path. It does not patch anything. Four flaws on the desk's tracked list entered CISA's Known Exploited Vulnerabilities catalogue in the seven days to 9 October, among them the FortiMail path traversal and the Cisco Catalyst SD-WAN Manager bypass, both internet-facing systems of exactly the kind a scanner reaches first. Whoever already holds scan results can still read them.

So the takedown is a real act of attribution and a real loss of infrastructure for the operator, but it is not a repair. The exposure it targeted lives on the defender's side: a management interface that answers any stranger on the internet will keep answering, whoever owns the scanner. Naming Integrity Tech tells the public who built the tools. It does not tell any organisation whether its own front door was already mapped.