FBI Seizes Flax Typhoon Domains Used in Critical Infrastructure Attacks

Fri, 09 Oct 2026 17:26:04 +0000

Engineer — Learn: No specific CVEs, IOCs, or affected software listed in the summary; the disruption is government-side. Monitor for follow-on FBI/CISA advisories that may name affected edge devices or configurations relevant to your environment.
SOC/IR — Act: A DOJ-confirmed Chinese APT campaign against critical infrastructure warrants an immediate hunt: review Flax Typhoon’s known TTPs (living-off-the-land, VPN/edge appliance footholds) and sweep logs since the campaign’s known activity window for related behaviors in your SIEM and EDR.
Leader — Act: A named, government-disrupted Chinese APT targeting U.S. critical infrastructure is board-question territory — brief leadership and assess whether your sector is in scope, then verify whether any edge or OT vendors used have issued related advisories.

Flax-Typhoon on CuraSec