FBI Disrupts Flax Typhoon Tools Targeting U.S. Critical Infrastructure

The U.S. Federal Bureau of Investigation (FBI) and the Department of Justice (DoJ) announced a coordinated disruption operation targeting Flax Typhoon, a China-linked advanced persistent threat group. As part of the operation, seven domains were seized and access to associated platforms was blocked. According to the agencies, these domains were used by Flax Typhoon to conduct reconnaissance scanning and, in some instances, to achieve initial access to U.S. critical infrastructure networks. The disruption is designed to limit the group's ability to identify vulnerabilities and infiltrate systems deemed critical to national security and public safety. The FBI and DoJ emphasized that the operation does not constitute a patch or fix for underlying software vulnerabilities but rather a law enforcement action to remove malicious infrastructure. CISA and the FBI have encouraged organizations to review network logs for indicators of compromise associated with Flax Typhoon and to implement recommended mitigations to strengthen their security posture. The full scope of sectors targeted and the number of systems previously accessed remain under investigation.