FBI Seizes Seven China-Linked Domains as Flax Typhoon Targets Critical Infrastructure Worldwide

Seven Domains, Two Hacking Platforms, One Strategic Warning for Critical-Infrastructure Security Teams

On October 8, 2026, the U.S. Department of Justice and FBI announced the court-authorized seizure of seven internet domains supporting two China-linked hacking platforms — designated MicroScan and FishHub — according to BleepingComputer and court documents summarized by The Register. Both platforms are reportedly attributed to Integrity Technology Group (Integrity Tech), a China-based firm with alleged ties to the PRC government; because this attribution currently rests primarily on a single sourced account of court filings rather than independently corroborated public statements, it should be treated as an allegation pending further confirmation. The action, reported by Reuters, BleepingComputer, The Register, ITnews Australia, and NHK World, was accompanied by an advisory issued by the FBI and partner agencies from the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain; involvement by CISA and NSA as formal co-issuing agencies has not been independently confirmed by sources available to this publication. The domain breakdown — one MicroScan domain, five FishHub delivery domains, and one SoftEther VPN-linked domain — reflects the layered, redundant architecture threat actors use to sustain long-term access. The activity cluster is publicly tracked as Flax Typhoon. Some researchers have reportedly linked this activity to groups tracked as Ethereal Panda and Red Juliett, though this has not been independently verified by this publication.

What distinguishes this operation from a typical law-enforcement action is the breadth and deliberateness of the targeting. According to court filings and the joint advisory, alleged targets include a South Carolina power company; airports in Japan and Poland; Taiwanese natural-gas and electricity companies; and a multinational NGO, as reported by The Register and corroborated by The Record. With respect to Taiwanese universities specifically, the two tools reflect distinct activity: FishHub reportedly compromised approximately 20 Taiwanese universities, while MicroScan activity was linked to two Taiwanese universities, according to DOJ reporting; the two figures should not be combined into a single unified count. These are allegations drawn from court documents and advisory claims, not independently adjudicated findings. The joint advisory additionally identifies government bodies, critical manufacturing, healthcare, law enforcement, information technology, education, and religious organizations as sectors within scope. This is not a narrowly focused espionage campaign; it appears to be a systematic effort to achieve presence across a wide topology of organizations, most of which share one characteristic — they operate or depend upon technology that, if disrupted, produces physical or societal consequences. For GSOC teams supporting energy, aviation, manufacturing, or telecommunications operations, the targeting list is less a curiosity and more a sector-level warning.

The technical methods documented in the advisory are worth understanding in operational terms, not merely as an IT checklist. Actors used automated vulnerability scanning through MicroScan, phishing, VPN infrastructure, compromised internet-connected devices assembled into botnets, and living-off-the-land techniques — that is, the use of legitimate system tools to move laterally so that activity blends with normal administrative traffic. This combination is particularly difficult to detect in OT network intrusion scenarios, where legacy systems may lack the logging granularity available in enterprise IT environments. Critically, U.S. officials assessed that China-linked actors have in some cases positioned themselves inside critical-infrastructure networks in ways that could enable future disruption, even where no disruptive action has yet occurred. The advisory does not assert that every compromised environment was pre-staged for sabotage, but the distinction between passive access and pre-positioned capability is a question that individual operators cannot yet answer from the outside. For corporate security directors, this ambiguity is itself the risk: the absence of a visible incident does not confirm the absence of a problem.

The Asia-Pacific cyber risk dimension is especially relevant for organizations with operational footprints, supply-chain dependencies, or data flows touching Taiwan, Japan, or the broader region. Taiwanese power and natural-gas companies appear among the alleged targets, and the multi-government advisory reflects a coordinated assessment — not a unilateral U.S. claim — that this activity is ongoing and geographically distributed. Organizations supporting NGO duty-of-care programs or operating humanitarian logistics in the region should also note that a multinational NGO was identified as an alleged target, consistent with a pattern in which non-profit and civil-society bodies are treated as intelligence-collection opportunities rather than neutral parties. GSOC teams managing Asia-Pacific exposure should treat unexplained edge-device behavior, abnormal VPN authentication patterns, and unauthorized access to engineering or operational files as indicators warranting physical-consequence assessment, not only IT escalation. Separately, according to a joint FBI and Secret Service advisory dated October 6, 2026, the FortiBleed campaign exploited a Fortinet vulnerability affecting a reported 86,644 devices across 194 countries, as detailed by Security Affairs. This suggests the current period represents elevated, concurrent pressure across perimeter infrastructure. Teams using Fortinet or similar products should cross-reference that advisory as a concurrent risk signal.

The broader intelligence picture points to a structural condition, not a singular event. Disruptive domain seizures and public attributions are important signals, but they do not remove pre-existing access from networks already compromised before the takedown. Organizations operating critical infrastructure in countries named in the advisory — or connected to those networks through vendor relationships or shared platforms — should be actively reviewing logs from the months preceding October 8, not just monitoring for new intrusions. For security directors tasked with communicating risk to executive leadership, the relevant framing is continuity: what functions, including physical operations, would be affected if access that is currently invisible were activated? Geospatial-intelligence and OSINT platforms that aggregate threat-actor infrastructure data, government advisory feeds, and network-adjacent open-source indicators can help GSOC analysts correlate warnings against their specific asset footprint before an advisory becomes an incident.

Request a live GeoBit demo

Sources

Reuters — U.S. announces effort to disrupt hacking infrastructure run by China's Integrity Tech

The Record — Flax Typhoon, China tools, Integrity Tech international takedown

BleepingComputer — FBI disrupts Chinese hacking tools used to breach critical infrastructure

The Register — US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide

ITnews Australia — ASD joins seven-nation alert as US seizes Chinese hacking firm's tools

NHK World — Seven domains seized to block access to two tools used to scan and hack critical infrastructure

Associated Press — FBI and Justice Department: China hacking tools targeted critical infrastructure

Cybersecurity Dive — FBI seizes domains tied to China botnet, Flax Typhoon

Security Affairs — FortiBleed hit 86,644 firewalls by exploiting something nobody can patch away

The Epoch Times — US seizes 7 domains used by China-linked hackers to target critical infrastructure

Ground News — The FBI has seized tools used by Chinese hackers for cyber operations

This article is for situational awareness only and is not a risk advisory.