FBI Seizes Domains Linked to Chinese “Flax Typhoon” Campaign Targeting Power, Airports, and Universities
What Happened — U.S. authorities seized seven internet domains that a Beijing‑based firm, Integrity Technology Group, used to host the MicroScan and FishHub intrusion tools. The tools supported large‑scale scanning, spear‑phishing, and data‑theft operations that hit a South Carolina power utility, airports in Japan and Poland, Taiwanese energy firms, universities, and an international NGO.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of external threat‑intel feeds is a core control that detects malicious infrastructure before it reaches your network.
- Demonstrating ongoing vendor and third‑party oversight (evidence of due‑diligence, sanctions checks, and activity logs) satisfies a single control objective that maps to many frameworks (SOC 2, ISO 27001, NIST CSF, etc.).
- Maintaining a defensible audit trail of domain‑blocking and incident‑response actions helps prove readiness during regulator or customer reviews.
Who Is Affected — Energy & utilities, aviation, higher‑education, non‑profit, and any organization with internet‑facing assets that could be scanned or phished.
Recommended Actions
- Integrate real‑time threat‑intel feeds into your DNS filtering and SIEM to block known malicious domains.
- Review and update third‑party risk registers to include sanctions‑listed entities and verify that any supply‑chain partners are not using the seized infrastructure.
- Capture and retain logs of inbound connections to the seized domains as evidence for audit and incident‑response documentation.
Technical Notes — The MicroScan tool bundles >1,300 penetration‑testing scripts targeting OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts. Operators routed scans through a Mirai‑derived botnet of >200 k compromised devices, masking source IPs. Source: DataBreachToday