FBI Disrupts Chinese Hacking Tools Used Against US Critical Infrastructure

Key takeaways

• The FBI seized seven domains used by Chinese state hackers to operate scanning and intrusion tools targeting US critical infrastructure.
• The disruption targeted Flax Typhoon's MicroScan and FishHub platforms, which scanned for vulnerabilities and infiltrated organizations worldwide.
• Critical infrastructure attacks threaten operational continuity, not just data security.
• Organizations should audit internet-facing assets, patch known vulnerabilities, and segment networks to limit attacker movement.
• Domain seizures slow adversaries but do not eliminate the threat; groups like Flax Typhoon will rebuild and continue operations.

What Happened

On October 8, the FBI and Department of Justice announced (https://www.bleepingcomputer.com/news/security/fbi-disrupts-chinese-hacking-tools-used-to-breach-critical-infrastructure/) the seizure of seven domains used by a Chinese state-sponsored hacking group known as Flax Typhoon. The domains hosted two tools, MicroScan and FishHub, that were used to scan for vulnerabilities and infiltrate critical infrastructure and other organizations worldwide.

The operation was court-authorized (https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html) and targeted the infrastructure itself, not individual victim networks. By seizing the domains, federal agents blocked Flax Typhoon's access to platforms they relied on to conduct reconnaissance and breach US systems. The FBI did not disclose how many organizations were affected, but critical infrastructure sectors, government agencies, healthcare systems, and other targets were compromised.

In a related disclosure the same day, the FBI and agencies from six other countries reported (https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html) that hackers tied to a Chinese cybersecurity company, Integrity Technology Group, stole emails from government, law enforcement, healthcare, and religious institutions in Southeast Asia. The company has now been sanctioned by the US and UK. While distinct from Flax Typhoon, the timing underscores the scale and coordination of state-linked hacking campaigns.

Why This Is an Issue

Flax Typhoon is categorized as an advanced persistent threat, or APT. That means they are well-resourced, patient, and focused on long-term access rather than quick smash-and-grab attacks. These groups do not vanish when one operation is disrupted. They adapt.

Critical infrastructure is the backbone of daily life: power grids, water systems, transportation networks, and communication lines. When adversaries gain access to these systems, the risk is not just data theft. It is operational disruption, physical damage, and cascading failures that can affect entire regions. The fact that scanning and intrusion tools were already deployed means Flax Typhoon was actively mapping attack surfaces and, in some cases, had already gained footholds.

The tools themselves, MicroScan and FishHub, allowed hackers to scan websites and networks for exploitable flaws. Once a weakness was identified, they could infiltrate systems and maintain access over time. This kind of infrastructure gives attackers leverage. It lets them operate at scale, targeting many organizations simultaneously without needing to rebuild their toolkit for each victim.

What You Can Do About It

If your organization operates or connects to systems that could be considered critical infrastructure, or if you handle sensitive data, take these steps now.

Audit your perimeter. Review internet-facing assets: web applications, VPNs, remote desktop services, and any admin portals. Make sure nothing is exposed that does not need to be. If you are not sure what is publicly visible, tools like Shodan or a basic external vulnerability scan can help. Many managed IT providers offer this as a standard service.

Patch known vulnerabilities. The scanning tools seized by the FBI were looking for known flaws. If your software is out of date, you are a target. Prioritize patches for web servers, content management systems, and anything that touches the internet. Set a cadence: monthly at minimum, weekly for critical systems.

Monitor for anomalies. If you do not have logging and alerting in place, start small. At a minimum, track failed login attempts, new user accounts, and changes to admin privileges. Cloud platforms and modern firewalls often include basic alerting. Turn it on.

Segment your network. If an attacker does get in, segmentation limits how far they can move. Keep your operational technology separate from your IT network. Restrict access between departments. Require authentication and logging at every boundary.

Protect your data with encryption and access controls. Encrypt data at rest and in transit. Limit who can access sensitive information, and require multi-factor authentication for any system that holds it. If credentials are stolen, MFA is often the last line of defense.

If you believe your organization may have been targeted or compromised, contact the FBI's Internet Crime Complaint Center at ic3.gov (https://www.ic3.gov) or your local FBI field office. The earlier you report, the more options you have.

Where This Is Heading

Domain seizures are a useful tactic, but they are not a permanent solution. Flax Typhoon and groups like them will rebuild. They will register new domains, retool their platforms, and continue operations. The FBI's action buys time and forces adversaries to regroup, but it does not eliminate the threat.

What is changing is the willingness of governments to act publicly. Sanctions against Integrity Technology Group, joint advisories from multiple countries, and high-profile disruptions signal a shift toward naming, blaming, and imposing costs on state-sponsored actors. Whether that deters future campaigns remains to be seen.

For businesses, the lesson is clear: assume you are a target, even if you do not think you are important enough. Scanning tools do not discriminate. They look for vulnerabilities everywhere. Your job is to make sure they do not find any on your network.

Start with the basics. Patch your systems. Lock down access. Monitor what is happening. And if you are responsible for critical infrastructure or sensitive data, treat security as an operational requirement, not an IT afterthought.