U.S. sanctions take aim at Chinese company said to aid hackers\u2019 massive botnet | CyberScoop<\/title> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/treasury-sanctions-chinese-company-flax-typhoon\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"U.S. sanctions take aim at Chinese company said to aid hackers\u2019 massive botnet\"> <meta property=\"og:description\" content=\"A joint takedown operation last year sought to disrupt Flax Typhoon\u2019s compromise of hundreds of thousands of devices.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/treasury-sanctions-chinese-company-flax-typhoon\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-01-03T19:58:06+00:00\"> <meta property=\"article:modified_time\" content=\"2025-01-03T19:58:09+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg\"> <meta property=\"og:image:width\" content=\"1024\"> <meta property=\"og:image:height\" content=\"683\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1732206022g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1730999764g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1732010462g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ddc036fa194c40cf406f\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83036\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83036\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ftreasury-sanctions-chinese-company-flax-typhoon%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ftreasury-sanctions-chinese-company-flax-typhoon%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83036 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/treasury-sanctions-chinese-company-flax-typhoon\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.446022727273\">\n<div class=\"single-article__header-content\" readability=\"34.090909090909\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/treasury-sanctions-chinese-company-flax-typhoon\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> A joint takedown operation last year sought to disrupt Flax Typhoon\u2019s compromise of hundreds of thousands of devices. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83036\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"427\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet.jpg?resize=640%2C427&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg?resize=505,337 505w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-2.jpg?resize=1012,675 1012w\" sizes=\"(max-width: 1012px) 100vw, 1012px\"><figcaption> The sun flares over the headquarters of the U.S. Treasury on Jan. 3, 2024, in Washington, D.C. (Photo by J. David Ake\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"25.026785714286\"><body readability=\"53.665782493369\"><\/p>\n<p>The U.S. government on Friday sanctioned a Chinese company that Western nations had connected to a Beijing-sponsored hacking group\u2019s botnet, which had compromised hundreds of thousands of devices before a joint takedown operation last year.<\/p>\n<p>Flax Typhoon hackers made use of infrastructure at Integrity Technology Group to exploit victims, according to the Treasury Department\u2019s Office of Foreign Assets Control. The firm builds cyber ranges to test cybersecurity tools and defenses and is reportedly <a href=\"https:\/\/cset.georgetown.edu\/wp-content\/uploads\/CSET-Downrange-A-Survey-of-Chinas-Cyber-Ranges-1.pdf\">one of the leading companies<\/a> to do so in China.<\/p>\n<p>\u201cBetween summer 2022 and fall 2023, Flax Typhoon actors used infrastructure tied to Integrity Tech during their computer network exploitation activities against multiple victims,\u201d Treasury\u2019s <a href=\"https:\/\/home.treasury.gov\/news\/press-releases\/jy2769\">Friday announcement<\/a> reads. \u201cDuring that time, Flax Typhoon routinely sent and received information from Integrity Tech infrastructure.\u201d<\/p>\n<p>The Flax Typhoon hackers targeted Internet of Things devices, such as cameras and video recorders, FBI Director Christopher Wray <a href=\"https:\/\/cyberscoop.com\/fbi-operation-china-botnet-flax-typhoon\/\">said in September<\/a> when announcing the takedown operation.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>It\u2019s the second time this week that the department has taken aim at Chinese hackers. Treasury <a href=\"https:\/\/cyberscoop.com\/treasury-workstations-hacked-china-beyondtrust-identity-access-management\/\">notified Congress<\/a> that they had hit its workstations. Friday\u2019s sanctions are designed to constrain the company\u2019s ability to do business in the United States, and to limit U.S. business dealings with the firm.<\/p>\n<p>Beyond the takedown operation and sanctions, Western government agencies also <a href=\"https:\/\/media.defense.gov\/2024\/Sep\/18\/2003547016\/-1\/-1\/0\/CSA-PRC-LINKED-ACTORS-BOTNET.PDF\">issued an advisory<\/a> on Flax Typhoon last year.<\/p>\n<p>\u201cThese multi-agency efforts reflect our whole-of-government approach to protecting and defending against PRC cyber threats to Americans, our critical systems, and those of our allies and partners,\u201d Matthew Miller, State Department spokesman, <a href=\"https:\/\/www.state.gov\/sanctioning-prc-cyber-company-involved-in-malicious-botnet-operations\/\">said Friday<\/a>. \u201cThe United States will continue to use all the tools at its disposal to safeguard U.S. critical infrastructure and the American people from irresponsible and reckless cyber actors.\u201d<\/p>\n<p>Although Integrity Technology Group presents itself as an information security company, Wray said that its \u201cchairman has publicly admitted that for years his company has collected intelligence and performed reconnaissance for Chinese government security agencies.\u201d<\/p>\n<p>\u201cThe Treasury Department will not hesitate to hold malicious cyber actors and their enablers accountable for their actions,\u201d said Bradley T. Smith, acting under secretary of the Treasury for terrorism and financial intelligence. \u201cThe United States will use all available tools to disrupt these threats as we continue working collaboratively to harden public and private sector cyber defenses.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/treasury-sanctions-chinese-company-flax-typhoon\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>U.S. sanctions take aim at Chinese company said to aid<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[271,1805,1673,273,669,679,2708,302,3406,172,1690,318,310,509],"tags":[277,1806,1675,279,671,680,2710,306,3407,176,1692,319,311,511],"class_list":["post-6795","post","type-post","status-publish","format-standard","hentry","category-china","category-christopher-wray","category-department-of-treasury","category-fbi","category-federal-bureau-of-investigation-fbi","category-financial","category-flax-typhoon","category-geopolitics","category-integrity-technology-group","category-internet-of-things","category-internet-of-things-iot","category-state-department","category-technology","category-treasury-department","tag-china","tag-christopher-wray","tag-department-of-treasury","tag-fbi","tag-federal-bureau-of-investigation-fbi","tag-financial","tag-flax-typhoon","tag-geopolitics","tag-integrity-technology-group","tag-internet-of-things","tag-internet-of-things-iot","tag-state-department","tag-technology","tag-treasury-department"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/china\/\" rel=\"category tag\">China<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/christopher-wray\/\" rel=\"category tag\">Christopher Wray<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-treasury\/\" rel=\"category tag\">Department of Treasury<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/fbi\/\" rel=\"category tag\">FBI<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/financial\/\" rel=\"category tag\">Financial<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/flax-typhoon\/\" rel=\"category tag\">Flax Typhoon<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/integrity-technology-group\/\" rel=\"category tag\">Integrity Technology Group<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/internet-of-things\/\" rel=\"category tag\">Internet of Things<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/internet-of-things-iot\/\" rel=\"category tag\">Internet of Things (IoT)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/state-department\/\" rel=\"category tag\">State Department<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/technology\/\" rel=\"category tag\">Technology<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/treasury-department\/\" rel=\"category tag\">Treasury Department<\/a>","tag_info":"Treasury Department","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6795"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6795\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6795"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6795"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":6795,"date":"2025-01-03T13:58:06","date_gmt":"2025-01-03T19:58:06","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83036"},"modified":"2025-01-03T13:58:06","modified_gmt":"2025-01-03T19:58:06","slug":"u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/03\/u-s-sanctions-take-aim-at-chinese-company-said-to-aid-hackers-massive-botnet\/","title":{"rendered":"U.S. sanctions take aim at Chinese company said to aid hackers\u2019 massive botnet"},"content":{"rendered":"