FBI Unmasks Flax Typhoon as Integrity Tech Group

The FBI disrupted a Chinese state-linked botnet run by Flax Typhoon, revealed as Integrity Technology Group, which hijacked IoT devices worldwide.

FBI Director Christopher Wray announced the disruption of a botnet operated by Flax Typhoon, a Chinese government-sponsored hacking group, at the 2024 Aspen Cyber Summit. The botnet compromised thousands of internet-connected devices—including storage devices, cameras, and video recorders—roughly half of which were located in the United States, to steal confidential data from public and private sector organizations, academia, and media outlets. Through a court-authorized operation, the FBI and partners removed the malware from infected devices, freeing them from the group's control.

Wray publicly attributed Flax Typhoon's operations to Integrity Technology Group, an information security company whose chairman has reportedly admitted the firm has performed intelligence collection and reconnaissance for Chinese government security agencies for years. Wray characterized the takedown as one round in an ongoing conflict, warning that Chinese state and proxy actors will continue targeting U.S. organizations and critical infrastructure.

The remarks also touched on broader FBI cyber initiatives, including nearly 1,000 ransomware decryptors distributed over two years saving victims roughly $800 million, and a joint advisory warning of a pro-Russian hacktivist group targeting operational technology networks across dams, wastewater, energy, and agriculture sectors. No specific malware family name, CVEs, or technical indicators were disclosed in this announcement.

Source reporting: https://www.fbi.gov/news/stories/fbi-director-announces-chinese-botnet-disruption-exposes-flax-typhoon-hacker-group-s-true-identity-at-aspen-cyber-summit