FBI Seizes Domains Tied to Chinese Group Behind Critical Infrastructure Hacks

The Federal Bureau of Investigation announced Monday that it has taken control of seven internet domains linked to the Chinese state‑backed hacking outfit known as Flax Typhoon. The seized sites were used to host two malicious utilities, MicroScan and FishHub, which analysts say have been instrumental in compromising power grids, water treatment facilities, and other essential services around the globe.

MicroScan functions as a reconnaissance engine, scanning wide‑area networks for unpatched software and misconfigured devices. Once a vulnerable target is identified, the tool hands off the intrusion to FishHub, a payload that can move laterally across a network, harvest sensitive data, and maintain persistent access for extended periods.

Security researchers traced the tools to a series of high‑profile incidents that unfolded over the past two years, including unexplained outages at a regional electric utility in North America and a water‑supply breach affecting municipal operations in Southeast Asia. While the exact damage assessments remain classified, officials indicated that the attacks disrupted normal operations and forced costly remediation efforts.

Flax Typhoon has been on U.S. intelligence watchlists for several years, identified as a unit operating under the auspices of China’s Ministry of State Security. The group’s previous campaigns have targeted aerospace firms, telecommunications providers, and government agencies, often leveraging custom‑built malware to evade detection.

The FBI’s takedown resulted from a joint investigation with cyber‑security firms and foreign law‑enforcement partners. By commandeering the domains, agents effectively cut off the command‑and‑control channels that allowed the malware to receive updates and exfiltrate data, dealing a significant blow to the operatives’ infrastructure.

Officials emphasized that the disruption underscores the growing vulnerability of critical‑infrastructure sectors to state‑sponsored cyber aggression. The move is also expected to send a diplomatic signal, as Washington and Beijing have repeatedly exchanged accusations over cyber‑espionage activities.

Authorities said the investigation remains active, with additional arrests and indictments possible as they continue to trace the network of actors behind the tools. In the meantime, the FBI urged organizations that manage essential services to audit their systems, apply security patches promptly, and adopt multi‑factor authentication to reduce the attack surface exposed by tools like MicroScan and FishHub.