VORANT. Threat Intelligence Research Create a free account

FBI Unmasks Flax Typhoon as Integrity Technology Group

Published Vorant ratingroutine threat Several sectors (5)Government (National), Media, Education, Infrastructure, Energy

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

FBI-led operation dismantled a Flax Typhoon botnet of hijacked IoT devices and revealed the Chinese state-linked group is actually Integrity Technology Group.

Sourcefbi.gov — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

FBI Director Christopher Wray announced at the Aspen Cyber Summit that a joint law enforcement operation disrupted a botnet run by Flax Typhoon, a Chinese government-sponsored hacking group. The botnet compromised thousands of internet-connected devices—including storage devices, IP cameras, and video recorders—roughly half of them in the United States, to steal confidential data from public and private sector organizations, academia, and media outlets. With court authorization, the FBI issued remote removal commands to strip malware from infected devices, though Wray characterized the takedown as only one round in an ongoing conflict with Chinese state-sponsored cyber activity.

Significantly, Wray publicly attributed Flax Typhoon's operations to Integrity Technology Group, an ostensibly private information security firm whose chairman has reportedly admitted to conducting intelligence collection and reconnaissance on behalf of Chinese government security agencies. This exposure represents a notable unmasking of a nation-state proxy relationship. Wray also referenced a separate, unrelated joint advisory warning that a pro-Russian hacktivist group had been targeting operational technology networks across dams, wastewater systems, energy, and food/agriculture sectors, which allowed private sector organizations to remediate the exploited vulnerability before further compromise.

The remainder of the remarks focused on the FBI's broader cyber engagement strategy, including its ransomware decryptor program (nearly 1,000 decryptors issued and roughly $800 million in ransom payments saved over two years) and the importance of victim reporting to enable decryption key matching and recovery support.

Mentioned in this report

Threat actors Flax Typhoon
Malware Flax Typhoon botnet malware

Source reporting: https://www.fbi.gov/news/stories/fbi-director-announces-chinese-botnet-disruption-exposes-flax-typhoon-hacker-group-s-true-identity-at-aspen-cyber-summit

Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs