The FBI and DOJ seized domains and disrupted scanning and spear-phishing tools used by Flax Typhoon, a China-linked threat group tied to Integrity Technology Group.

The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]

: Crims turned trusted mapping software into a hideout - no traditional malware required

Researchers warn of a new IoT botnet called Raptor Train that already compromised over 200,000 devices worldwide.

Our analysis revealed behavioral signals and infrastructure overlaps consistent with Flax Typhoon’s tactics.

China-linked threat actors have shifted from individually procured infrastructure to large-scale covert networks and botnets built from compromised SOHO routers, IoT, and other edge devices, the NCSC warns. The NCSC and partner agencies issued an advisory urging organizations to map and baseline edge-device traffic, monitor VPN and remote access connections, and adopt dynamic threat-feed filtering using known covert-network indicators. #FlaxTyphoon #IntegrityTechnologyGroup

Die US-Bundespolizei FBI hat ein Botnetz, bestehend aus hundert­tau­sen­den internetfähigen Geräten wie Kameras, Videorekordern, Spei­cher­geräten und Routern, unter Kontrolle gebracht. Dieses wurde v...

A Chinese company was sanctioned for cyberespionage on the United States government and related infrastructure via a cybercriminal group.

 Chinese state-backed hacking group Flax Typhoon has been exploiting a feature within Esri’s ArcGIS software to maintain covert access to targeted systems for more than a year, according to new findings from ReliaQuest. The group, active since at least 2021 and known for espionage operations against entities in the U.S., Europe, and Taiwan, weaponized ArcGIS’s Server Object Extension (SOE) to transform the software into a webshell—essentially turning legitimate features into tools for persistent compromise. Researchers found that the attackers targeted a public-facing ArcGIS server linked to a private backend server. By compromising the portal administrator credentials, they deployed a malicious extension that forced the system to create a hidden directory, which became their private command and control workspace.  This extension included a hardcoded key, shielding their access from others while ensuring persistence. The hackers maintained this access long enough for the malicious file to become embedded in backup systems, effectively guaranteeing reinfection even if administrators restored the system from backups. ReliaQuest described this as a particularly deceptive attack chain that allowed the group to mimic normal network activity, thereby bypassing typical detection mechanisms. Because the infected component was integrated into backup files, standard recovery protocols became a liability — a compromised backup meant a built-in reinfection vector. The tactic showcases Flax Typhoon’s hallmark strategy of exploiting trusted internal processes and tools rather than relying on advanced malware or sophisticated exploits. This method is consistent with Flax Typhoon’s history of leveraging legitimate software components for espionage. Microsoft had previously documented the group’s capability to maintain long-term access to dozens of Taiwanese organizations using built-in Windows utilities and benign applications for stealth. The U.S. Treasury Department has sanctioned Integrity Technology Group, a Beijing-based company implicated in supporting Flax Typhoon’s operations, including managing infrastructure for a major botnet dismantled by the FBI. ReliaQuest warned that the real danger extends beyond ArcGIS or Esri’s ecosystem — it highlights the inherent risks in enterprise software that depends on third-party extensions or backend access. The researchers called the case a “wake-up call,” urging organizations to treat every interface with backend connectivity as a high-risk access point, regardless of how routine or trusted it appears.

Botnet operated by Chinese state-sponsored threat actor known as Flax Typhoon has been abandoned by the group after law enforcement action.

The US government has announced the disruption of Raptor Train, a Flax Typhoon botnet powered by hacked consumer devices.

China-based actor Flax Typhoon is exploiting known vulnerabilities for public-facing servers, legitimate VPN software, and open-source malware to gain access to Taiwanese organizations, but not taking...

SBWRD in Utah says it isolated an intrusion on its ArcGIS server after files were encrypted and recovered; no operational impact reported.