US authorities took over infrastructure behind two hacking platforms tied to a China-linked group accused of intrusions into critical infrastructure.
The FBI and DOJ announced the seizure of seven domains used to run infrastructure for Flax Typhoon, a China-linked hacking group also tracked as Ethereal Panda and RedJuliett. The seized domains supported two platforms, MicroScan, a scanning tool, and FishHub, used for spear-phishing and data theft, plus a domain tied to SoftEther VPN software the group used to keep remote access open on victim networks. The group is associated with Integrity Technology Group, a Beijing-based company that US officials say contracts with the Chinese government. The action was paired with a joint cybersecurity advisory from the FBI, CISA, NSA and international partners.
Officials say the tools were used in intrusions against critical infrastructure, with targets named including a US power company in South Carolina, a multinational NGO, Japanese and Polish airports, and Taiwanese natural gas, power and university networks. The FBI did not disclose whether every named organization was successfully breached. The takedown follows earlier US action against Integrity Tech, including a 2024 disruption of its Raptor Train botnet and a 2025 sanction.
Why it matters: nation-state groups keep targeting the VPN tunnels and remote-access tooling enterprises depend on for day-to-day operations. Treat this as a prompt to audit SoftEther and other remote-access software for unauthorized use, and to feed fresh threat-intel indicators like these into cloud and infrastructure monitoring rather than filing them away as background reading.