US Seizes Domains Linked to Chinese Hacking Group Flax Typhoon
Washington, October 2026: The US Department of Justice and the FBI have seized seven internet domains that supported two hacking tools linked to the Chinese threat actor known as Flax Typhoon.
The tools
| Tool | Alleged purpose |
|---|---|
| Microscan | Scanning the internet for vulnerable systems |
| FishHub | Supporting spear-phishing campaigns |
US authorities linked the infrastructure to Integrity Technology Group, a China-based cybersecurity company with government contracts. China has rejected US allegations of state-sponsored hacking.
Who is Flax Typhoon?
"Flax Typhoon" is the name Microsoft and US agencies use for a China-linked hacking group. In September 2024, the US and allies announced the disruption of a large botnet of hundreds of thousands of compromised internet devices, such as routers and cameras, that authorities attributed to Integrity Technology Group and Flax Typhoon. The US Treasury later sanctioned the company.
How domain seizures work
- Authorities obtain a court order to take control of domains used by criminals.
- Visitors to those domains then see a seizure banner instead of the malicious service.
- This disrupts the tools, though attackers may try to rebuild elsewhere.
What is spear-phishing?
Spear-phishing is a targeted phishing attack. Criminals send personalised emails or messages that appear to come from trusted sources to trick specific people into clicking malicious links or revealing passwords. It is one of the most common ways hackers gain initial access to organisations.
Why it matters
- US–China tensions: cyber operations are a major source of friction alongside trade and technology disputes.
- Critical infrastructure: scanning tools can identify vulnerable systems in utilities, telecoms and governments worldwide.
- Global relevance: Indian organisations also face sophisticated phishing and scanning attacks, and CERT-In regularly issues advisories on such threats.
Protecting yourself
- Use multi-factor authentication
- Verify unexpected emails, especially those requesting credentials or payments
- Keep internet-facing devices such as routers and cameras updated
Sources
- TechStartups, "Tech News Weekly Roundup" (9 October 2026): https://techstartups.com/2026/10/09/tech-news-weekly-roundup-the-biggest-stories-in-ai-big-tech-startups-and-cybersecurity/
- US Department of Justice press releases: https://www.justice.gov/news