FBI seizes 7 domains, disrupts Flax Typhoon critical infrastructure intrusion tools

The FBI and DoJ announced the seizure of 7 domains and blocking of access to related platforms, striking at malicious tools used by the China-linked APT group Flax Typhoon (also known as Ethereal Panda, RedJuliett) to scan and infiltrate U.S. critical infrastructure. Court documents allege that its affiliated company Integrity Tech operated an IoT botnet based on a Mirai variant, with a database containing records of over 1.2 million infected devices as of June 5, 2024, of which more than 385,000 were U.S. devices. The group also used the Microscan scanning tool and FishHub, with the latter's related activity confirming 20 Taiwanese universities as victims.