Dive Brief:

• The Office of Foreign Assets Control has imposed sanctions on a Beijing-based cybersecurity company linked to the state-sponsored threat group, Flax Typhoon, the Department of Treasury said Friday. 
• The agency said Integrity Technology Group Inc. has engaged in a series of malicious cyber activities against various critical infrastructure providers and other targets in the U.S. Between the summer of 2022 and fall 2023, Flax Typhoon engaged in exploitation activity using Integrity Technology infrastructure, according to U.S. officials.
• “The Treasury Department will not hesitate to hold malicious cyber actors and their enablers accountable for their actions,” said Acting Under Secretary for Terrorism and Financial Intelligence Bradley Smith, in a statement. “The United States will use all available tools to disrupt these threats as we continue working collaboratively to harden public and private sector cyber defenses.”

Dive Insight:

Flax Typhoon is one of several state-linked threat groups that has engaged in attacks against U.S. critical infrastructure in recent years. Officials said Flax Typhoon has been active since at least 2021, compromising computer networks in North America, Europe, Africa and Asia, with particular focus on Taiwan.

Officials said from 2022 to 2023, Flax Typhoon used VPN software and remote desktop protocols to help gain access to hosts in the U.S. and Europe. Flax Typhoon compromised servers and workstations at a California-based organization, according to officials.

According to the State Department, Flax Typhoon hackers have successfully targeted the U.S. government, telecommunications providers, media organizations and several American and foreign companies.

In September 2024, the FBI said it disrupted a botnet that compromised more than 260,000 devices worldwide in order to target critical infrastructure in the U.S. and other countries. The botnet, linked to Flax Typhoon, compromised small office/home office routers and other connected devices, exploiting them with a Mirai malware variant to target critical infrastructure for DDoS attacks and theft. 

The FBI in September issued an international advisory with the Five Eyes intelligence partners highlighting the threat posed by Flax Typhoon. The advisory detailed the alleged role of Integrity Technology. 

The U.S. in recent months has also been investigating a series of attacks from another China state-linked threat group called Salt Typhoon targeting the telecom industry 

Officials at the Foundation for Defense of Democracies said the sanctions are appropriate and the minimum the U.S. should be doing. 

“Flax Typhoon is yet another successful [Chinese Communist Party] effort to use cyber tools to conduct espionage, intellectual property theft and preparation of the cyber battlefield to weaken U.S national security and economic productivity,” Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at FDD, said via email.

Montgomery said the CCP is launching a full scale cyber campaign against the U.S. and the country is not prepared for the fight.