# FBI and DoJ Disrupt China-Linked Cyber Threats Targeting Critical Infrastructure

*Published October 12, 2026*
*Source: [https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html](https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/fbi-and-doj-disrupt-china-linked-cyber-threats-targeting-critical-infrastructure) or [see plans](https://www.sec-news.ai/pricing).*

## Article

The FBI and the Department of Justice have successfully disrupted malicious cyber tools tied to a Chinese-linked advanced persistent threat group known as Flax Typhoon. This operation involved seizing several domains and blocking access to platforms used to target U.S. critical infrastructure. Flax Typhoon, also known as Ethereal Panda and RedJuliett, is associated with the Beijing-based company Integrity Technology Group. This group has been linked to a botnet called Raptor Train, which was dismantled in September 2024. The botnet leveraged a variant of the Mirai malware to control over 1.2 million compromised devices, including more than 385,000 in the U.S. The FBI's investigation revealed that the botnet was managed using a tool named Sparrow and used the domain 'w8510[.]com' for its command-and-control operations. Additionally, the group employed a reconnaissance tool called Microscan, which facilitated the scanning of networks for vulnerabilities. This tool has been active since 2017 and was recently accessible via the domain 'c0cc[.]cc'. Microscan's capabilities include over 1,300 scripts for identifying vulnerabilities in various platforms such as OpenSSL and WordPress. The targeted entities include a U.S. power company, international airports in Japan and Poland, and critical infrastructure companies in Taiwan. Another tool, FishHub, was used for spear-phishing attacks and was confirmed to have compromised 20 Taiwanese universities. These actions highlight the collaboration between U.S. and international agencies to curb the expansion of China's cyber threat capabilities. The U.S. State Department has also announced rewards for information leading to the capture of Zhang Yu, a Chinese national linked to the 2021 Microsoft Exchange Server attacks. This joint effort underscores the ongoing battle against state-sponsored cybercrime aimed at critical infrastructure worldwide.