Seven Nations Name Beijing Contractor Behind Flax Typhoon Hacking Infrastructure

A joint advisory and US domain seizures move allied pressure from China-linked hackers to the commercial firm that allegedly built their tools.

Intelligence Lead

Allied governments have for the first time in this campaign placed a named Chinese contractor, Integrity Technology Group, at the centre of a state-linked hacking ecosystem, and the US has physically disrupted its infrastructure. The advisory indicates that China outsources scanning, phishing and botnet capability to commercial suppliers, which makes those suppliers the more durable target.

Situation Report

On 9 October, agencies from the United States, United Kingdom, Australia, Canada, Japan, New Zealand and Spain issued joint advisory AA26-281A. It names Integrity Technology Group, a Beijing-based firm that the US Justice Department says holds Chinese government contracts, as an enabler of the actor tracked as Flax Typhoon, also known as Ethereal Panda and RedJuliett. The FBI and Justice Department separately announced court-authorised seizure of seven domains, including c0cc[.]cc, which hosted the MicroScan tool.

According to the advisory and court filings, MicroScan is a Python-based scanner carrying more than 1,300 penetration-testing scripts, with origins reportedly dating to 2017. FishHub was used for spear-phishing and follow-on payload delivery, and an application called Sparrow managed a botnet built on a Mirai variant. Court documents allege Integrity created and operated that botnet. A database server recorded more than 1.2 million infected devices as of June 2024, including over 385,000 in the United States.

Named or described victims include a South Carolina electricity company, a multinational non-governmental organisation, airports in Japan and Poland, Taiwanese natural gas and power operators, and about 20 Taiwanese universities confirmed as FishHub targets. The FBI also recovered email archives from government, law enforcement, healthcare and religious institutions in Southeast Asia. Reported techniques include cross-site scripting for credential harvesting, SoftEther VPN clients for persistence, brute-forcing of Microsoft 365 accounts, and DCSync credential theft from Active Directory.

FBI Cyber Division Assistant Director Brett Leatherman said Integrity gave China-linked actors the means for widespread scanning and, at times, intrusion into critical infrastructure, and that disrupting enablers makes American networks harder to target. The UK National Cyber Security Centre stated that the actors combine AI-assisted automated scanning with botnets and manual exploitation. No Chinese government response appears in the reporting reviewed.

Background & Context

Flax Typhoon was previously tied to the Raptor Train botnet, which the US dismantled in September 2024. Integrity Technology Group and Sichuan Anxun Information Technology, the firm behind the i-Soon leaks, were sanctioned in late 2025. The latest action builds on that record and on a longer pattern of indictments against contractor-linked operators, including the HAFNIUM or Silk Typhoon Exchange campaign. The State Department is offering up to 10 million dollars for information on Zhang Yu, charged in that case, and co-defendant Xu Zewei was extradited from Italy in April 2026.

The model matters because it separates the capability supplier from the intelligence customer. Commercial vendors sell tooling and hosted infrastructure to multiple state-aligned groups, which spreads cost, complicates attribution and gives Beijing plausible distance from individual intrusions.

Analysis & Assessment

It is assessed with high confidence that the allied strategy has changed from naming operators to targeting the supply chain behind them. Domain seizures impose short-term friction, but infrastructure of this type is cheap to rebuild, and the botnet's command layer spans many domains beyond the seven taken down. The lasting effect is more likely to come from financial and legal pressure on the firm, its executives and its customers.

The victim set suggests dual purposes. Taiwanese energy and university targeting points to pre-positioning and research collection, while airports and power utilities in allied states indicate reconnaissance of critical infrastructure that could be exploited in a crisis. The mention of AI-assisted scanning is notable but should be read cautiously: it describes automation of existing methods rather than a confirmed new capability.

Expect Beijing to reject the attribution and possibly to counter-name Western firms. Expect further contractor designations, and expect network defenders to prioritise patching of older, widely known vulnerabilities, which the advisory shows these actors still exploit effectively.