The FBI has recently disrupted a second Chinese hacking group known as "Flax Typhoon," recovering thousands of compromised devices in the process. FBI Director Christopher Wray revealed this information during a speech at the Aspen Cyber Summit in Washington, where he mentioned that the group was being operated by a Chinese company called Integrity Technology Group. Wray stated that this company was collecting intelligence and performing reconnaissance for Chinese government security agencies while posing as an IT firm.
The group, Flax Typhoon, was utilizing a botnet to route malicious traffic through hijacked devices, including cameras and digital storage devices commonly found in organizations. Wray mentioned that approximately half of the compromised devices were located in the United States. As the FBI Cyber Action Team attempted to gain control over the botnet, the hackers launched a DDOS cyberattack before ultimately abandoning the botnet.
Wray also highlighted the similarities between Flax Typhoon and a previous hacking group known as "Volt Typhoon," which has been an ongoing concern since its identification last year. He noted that Volt Typhoon has embedded itself successfully in critical infrastructure companies in the United States, including those in telecommunications, energy, and water sectors.
While Microsoft and Google security experts have previously linked Volt Typhoon hackers to China, the Chinese Ministry of Foreign Affairs has denied any government involvement, stating that the group is part of a criminal ransomware operation. Despite this denial, Wray emphasized that combating Chinese hacking groups remains a top priority for the FBI due to ongoing U.S.-Chinese tensions.
In conclusion, Wray warned organizations and critical infrastructure to remain vigilant as the Chinese government continues to target them directly or through proxies. Dealing with these hacking groups remains an ongoing challenge for the FBI as they work to protect American interests and infrastructure.