FBI Seizes 7 Domains Linked to Chinese Security Firm Powering Flax Typhoon Botnet

The FBI successfully seized seven web domains associated with hacking tools allegedly operated by Chinese security firm Integrity Technology Group. A joint security advisory from the US, UK, Australia, Canada, Japan, New Zealand, and Spain warned that these tools are actively targeting global critical infrastructure. The US Cybersecurity and Infrastructure Security Agency (CISA) responded by adding five specific CVEs linked to the activity to its Known Exploited Vulnerabilities Catalog. Court documents allege the group's Mirai-based botnet, which comprised roughly 260,000 infected devices before its disruption in September 2024, was used by the Flax Typhoon cybercrew to scan a South Carolina power company and multiple airports. "These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts," — US security alert.