Our takeDOJ seized domains behind "QScan" and "QTRouter," tools it says a Chinese state-run group used via the firm Nanjing Xinjiuwei to hit NASA, Justice, and the Senate. A seizure buys friction, but doesn't end the dight against malicious domains. No indicators published yet, so nothing changes defensively today.Cyber Resilience desk
Sources (4)
- therecord · therecord
- hackread · hackread
- hackernews · hackernews
- helpnet · helpnet
What this means for you — Security leader:Seized domains and tools reduce one scanning and initial-access vector tied to Flax Typhoon; continue blocking common living-off-the-land binaries, monitor for anomalous scanning from Chinese IP ranges, and keep vulnerability management current.
What this means for you — Lean IT orgs:The tools used for widespread scanning and some intrusions have been taken down. Keep all internet-facing systems patched, use strong unique passwords, and turn on multi-factor authentication everywhere you can.
What this means for you — MSP:Flax Typhoon activity often targets MSPs and their downstream customers via unpatched systems and credential abuse. Review client internet exposure, enforce timely patching, and watch for anomalous scanning or living-off-the-land activity across managed estates.
What this means for you — Researcher:DOJ and international partners seized seven domains and disrupted Microscan and FishHub tools used by Integrity Technology Group in the Flax Typhoon campaign against critical infrastructure.