1. Executive summary
The FBI and US Department of Justice announced the seizure of seven domains and the blocking of platforms used by a China-linked APT tracked as Flax Typhoon to scan and, in some cases, infiltrate US critical infrastructure. An international coalition also took down digital tools and infrastructure belonging to Beijing-based Integrity Tech, the firm assessed as operating the scanning and intrusion capability behind the campaign. The primary source does not name the seized domains, the affected sectors, or the specific CVEs exploited, and the related reporting adds no atomic indicators. Attribution to Flax Typhoon and to Integrity Tech is single-sourced and unconfirmed: the verified reference data holds no MITRE ATT&CK profile for this actor, so treat the naming as an open lead, not an established fact. For EMEA financial services the direct exposure is low until the seized infrastructure is published, but the campaign's focus on internet-facing scanning against critical infrastructure means any externally reachable estate is in scope for the same reconnaissance.
2. Regulatory framing
The item is a law-enforcement disruption of adversary infrastructure. It does not describe an incident at a client, a supply-chain compromise of a client's ICT provider, or a testing obligation. No specific DORA/NIS2 article is directly engaged by this item.
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| n/a | n/a | n/a |
If a client later confirms it was scanned or accessed through the seized infrastructure, DORA Art. 17 (ICT-related incident management process) and Art. 18 (classification of ICT-related incidents and cyber threats) become relevant to the internal handling and classification of that event, and NIS2 Art. 23 (incident reporting obligations) to any reportable incident. Those triggers are not present in this item.
3. Technical analysis & attack chain
The source material is thin. It confirms a disruption action and a set of capabilities, not a step-by-step intrusion. The following is what is actually established.
- Integrity Tech, a Beijing-based company, operated digital tools and infrastructure used for widespread vulnerability scanning and, in some cases, intrusions.
- Those tools and infrastructure were used in the Flax Typhoon campaign against US critical infrastructure.
- The FBI and DoJ seized seven domains and blocked access to platforms used to scan and in some cases infiltrate that infrastructure.
- An international coalition participated in taking down the Integrity Tech tooling and infrastructure.
What the sources do not provide: the seized domain names, the IP addresses or hosting providers involved, the scanning tooling or implants used, the exploited CVEs, the targeted sectors or victim organisations, the initial-access vector, persistence mechanisms, command-and-control protocols, lateral-movement techniques, or any exfiltration detail. None of that is in the primary item or the related reporting, and it is not reproduced here.
The capability described is mass internet-facing vulnerability scanning with opportunistic follow-on intrusion. That is a reconnaissance-and-exploitation pattern, not a targeted campaign with a named victim set. The operational significance for a defender is that the scanning surface is the whole externally reachable estate, and the intrusion step is triggered by whatever unpatched, internet-facing service the scan finds.
Confidence caveats. The attribution of the tooling to Integrity Tech and the linkage to Flax Typhoon rest on a single related source (The Record) plus the primary item, which repeats the Flax Typhoon name without adding technical detail. The verified reference data contains no MITRE ATT&CK profile for Flax Typhoon, so the actor mapping is unconfirmed. Do not build detection or blocking logic on the actor name alone. The seven seized domains are not published in the source material, so no domain-based enforcement is possible from this advisory.
4. Mitigation & containment
The disruption removes adversary infrastructure; it does not remove the exposure that infrastructure was scanning for. The actions below address the exposure, not the takedown.
P1 (within 24 hours)
- Inventory every internet-facing service in the estate and confirm the patch state of each. The campaign's entry condition is an unpatched externally reachable service, so the priority is the external attack surface, not internal hosts.
- Confirm that external vulnerability scanning is running against the full public range and that findings are triaged, not just collected. If the adversary was scanning the same surface, the client's own scan should already show the same findings.
- Review edge and perimeter logs for the period before the takedown for scanning patterns against public services: high-volume requests to a single path, sequential port swe eps, or user-agent strings consistent with automated scanners. The source gives no specific signatures, so this is pattern-based review, not IOC matching.
P2 (within 72 hours)
- Where an internet-facing service cannot be patched immediately, restrict it to known source ranges or place it behind authentication. Reducing reachability removes the scan-to-exploit path.
- Verify that EDR and network detection cover the perimeter hosts, not only endpoints. Scanning and initial exploitation happen at the edge.
- Confirm that any host that was reachable and unpatched during the campaign window has been checked for post-exploitation activity: new local accounts, new scheduled tasks, new services, and outbound connections to unfamiliar destinations.
P3 (within 7 days)
- Reconcile the external attack surface inventory against the asset register. Services that appear in scanning but not in the register are the ones most likely to be missed by patching.
- Add the seized domains to blocklists once the FBI or DoJ publishes them. They are not in the source material, so this step is pending publication, not actionable today.
No vendor fix, version number, file path, registry key, or command is named in the source material. Do not expect this advisory to supply them.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources name no domains, IP addresses, hashes, file paths, registry keys, or command-line artefacts. The seven seized domains are referenced but not listed. There is no atomic indicator set to publish, and none has been fabricated to fill this section.
6. Detection
Insufficient indicators to author detection rules.
The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values belonging to the threat. The only named entities are the actor (Flax Typhoon), the company (Integrity Tech), and the seizing agencies, none of which are artefacts of the malware or tooling. A rule built on those names would detect reporting about the campaign, not the campaign.
7. Sources
- The Hacker News, "FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions", https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html, 2026-10-09.
- The Record (Recorded Future), "International coalition seizes tools used by cyber firm behind Flax Typhoon", https://therecord.media/flax-typhoon-china-tools-integrity-tech-international-takedown, date not stated in the provided material.
8. Adverse Trace position
Adverse Trace assesses this as a disruption event with no confirmed client impact and no actionable technical indicators. The attribution to Flax Typhoon and Integrity Tech is single-sourced and unconfirmed against the verified reference data, which holds no MITRE ATT&CK profile for the actor, so we are not treating the naming as established. The severity of the underlying capability is real for any organisation with unpatched internet-facing services, but this advisory cannot quantify it because the exploited CVEs and victim sectors are not published. We will monitor for the FBI/DoJ publication of the seven seized domains and any accompanying technical annex, and we will issue a follow-up with atomic indicators and detection rules when that material is available. Clients who identify scanning or access consistent with the campaign window should treat it as a potential incident and route it through their DORA Art. 17 process.
Published via PulseTrace — Adverse Trace threat intelligence.