**Disrupting the Digital Shield: How Authorities Took Down Flax Typhoon’s Cyber Infrastructure**
Federal authorities have successfully dismantled a suite of malicious tools employed by a Chinese-linked advanced persistent threat group known as Flax Typhoon. In a coordinated effort, the FBI and the Department of Justice seized several internet domains and blocked access to platforms that had been used to scan—and occasionally infiltrate—United States critical infrastructure.
Flax Typhoon, also tracked under the aliases Ethereal Panda and RedJuliett, is associated with Integrity Technology Group, a Beijing-based company that holds contracts with the Chinese government. This group had previously been linked to a massive botnet called Raptor Train, which compromised thousands of small office and home office routers alongside various Internet of Things (IoT) devices. A U.S. court-authorized operation in September 2024 had previously attempted to take down this botnet, but the group’s underlying infrastructure remained persistent.
The recent operation targeted seven specific web addresses: c0cc[.]cc, 98aiblog[.]com, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net. These domains served as critical hubs for command-and-control communications and hosted a variety of cyber weapons.
At the heart of the network was a database server that cataloged over 1.2 million infected devices as of early June 2024. Among these records, more than 385,000 were uniquely identified as victims within the United States, with roughly 260,000 devices remaining actively infected at the time. The botnet itself was controlled via an application named Sparrow, leveraging a modified variant of the infamous Mirai malware. Command-and-control traffic was routed through subdomains associated with w8510[.]com, enabling bidirectional communications between the operators and the compromised devices.
One of the primary tools disrupted was Microscan, a Python-based web utility that had been operational since at least 2017. Equipped with over 1,300 penetration testing scripts, Microscan was designed to sweep websites for specific vulnerabilities in systems like OpenSSL, Oracle WebLogic, WordPress, and Apache Struts. It was complemented by a range of open-source scanning utilities to map out network weaknesses. A second tool, known as FishHub, allegedly enabled the group to conduct spear-phishing attacks and deploy follow-on payloads. Once installed, FishHub provided unauthorized remote access to victim networks and searched for specific files, sending them back to servers controlled by the threat actors.
The targets of this campaign spanned the globe, including a U.S. power utility based in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese companies in the natural gas and power sectors, and two Taiwanese universities. The attackers employed a wide range of tactics, utilizing Python- and Go-based command-line utilities to break into networks, exploiting cross-site scripting flaws to harvest user credentials, and installing SoftEther VPN software on victim devices to maintain long-term persistence. They also used brute-force tools to compromise Microsoft 365 cloud environments and steal mailbox data.
This disruption coincides with a joint cybersecurity advisory issued by intelligence and security agencies from the United States, the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain. The advisory highlights how for-profit companies are contracted by the People’s Republic of China to develop, acquire, and deploy cyber tools globally. By exposing and dismantling these enabling entities, authorities aim to make it significantly harder for Beijing to target American networks and infrastructure. U.K. cybersecurity experts have noted the unique integration of AI-driven automated scanning alongside large-scale botnets and manual exploitation techniques used by these actors.
Adding further context to the broader landscape of state-sponsored cyber operations, the U.S. State Department recently announced rewards of up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks. This campaign, tracked as Silk Typhoon, also saw the extradition of co-defendant Xu Zewei from Italy to the United States in April 2026, where he faces allegations of stealing COVID-19 research from American universities and scientists.
***
**FAQ: Understanding the Flax Typhoon Disruption**
**Q: What exactly is Flax Typhoon?**
A: Flax Typhoon is a China-linked advanced persistent threat group, also known as Ethereal Panda or RedJuliett. It is associated with Integrity Technology Group, a firm in Beijing that contracts with the Chinese government to conduct cyber operations.
**Q: Why were these specific domains seized?**
A: The seven domains seized—including c0cc[.]cc and 98aiblog[.]com—were actively hosting tools used to scan for vulnerabilities in networks and, in some cases, to infiltrate U.S. critical infrastructure and commandeer compromised devices.
**Q: What kind of devices were affected by the Raptor Train botnet?**
A: The botnet primarily compromised small office/home office (SOHO) routers and Internet of Things (IoT) devices, leveraging a variant of the Mirai malware to seize control of the hardware for large-scale scanning and attack campaigns.
**Q: What were the primary tools used by the hackers?**
A: The two main tools disrupted were Microscan, a comprehensive Python-based vulnerability scanner with over 1,300 scripts, and FishHub, a tool designed for spear-phishing attacks and deploying remote access payloads to steal files from victim networks.
**Q: Who were the victims of these attacks?**
A: Victims included a U.S. power company in South Carolina, a multinational NGO, airports in Japan and Poland, Taiwanese critical infrastructure companies in the gas and power sectors, and multiple Taiwanese universities.
**Q: How did the attackers maintain access to compromised networks?**
A: They installed SoftEther VPN software on victim devices to create persistent, encrypted tunnels back to their servers. They also used brute-force tools to crack Microsoft 365 accounts and harvested credentials using cross-site scripting attacks.
***
**Conclusion**
The dismantling of Flax Typhoon’s infrastructure marks a significant blow against state-sponsored cyber espionage. By targeting the specific tools and domains used to compromise critical infrastructure, authorities have temporarily hindered the group’s ability to conduct widespread reconnaissance and data theft. However, this operation also underscores the persistent threat posed by contracted cyber actors who leverage commercial-looking companies to mask state-sponsored agendas. As international agencies continue to expose and disrupt these networks, the focus must also shift toward securing vulnerable IoT and SOHO devices, which remain the weak links exploited by botnets like Raptor Train. The fight against cyber threats requires continuous vigilance, robust international cooperation, and relentless pressure on the enablers who provide malicious capabilities to state actors.
Thank you for reading
