Loading story…
The U.S. Treasury imposed sanctions on a China-based cybersecurity company tied to the compromise of firewall products, activity associated with the Flax Typhoon hacking campaign, and attempted ransomware attacks against U.S. victims. Reporting said the company operated infrastructure and services that supported intrusions, with the action aimed at disrupting a broader ecosystem used to access victim networks and enable follow-on malicious operations.
Treasury later expanded its cyber-related sanctions by targeting Funnull Technology, which U.S. officials described as a major facilitator of online fraud and cyber scams that caused more than $200 million in losses. Authorities said the company provided technical infrastructure that helped criminals run scam platforms and conceal their operations, underscoring a broader U.S. effort to use financial sanctions against firms accused of enabling both state-linked intrusions and large-scale cyber-enabled fraud.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
The U.S. Treasury took action against Funnull Technology, describing it as a major facilitator of cyber scams that enabled more than $200 million in victim losses. The sanctions targeted the company's role in providing infrastructure used to support large-scale online fraud operations.
The U.S. Treasury announced sanctions against Integrity Technology Group for its role in compromising firewall products and supporting cyber operations associated with Flax Typhoon, including attempted ransomware attacks. The action publicly linked the company to the broader China-backed intrusion campaign.
Integrity Technology Group, a Beijing-based cybersecurity company, was identified as infrastructure support for the China-linked Flax Typhoon hacking campaign, which compromised firewall products and was tied to attempted ransomware activity. The activity occurred before the U.S. sanctions action and forms the basis for later enforcement.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
techmonitor.ai
Open sourcehome.treasury.gov
Open sourcebleepingcomputer.com
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and private-sector researchers said the China-linked threat actor **Flax Typhoon** operated a sprawling IoT botnet known as **Raptor Train** to conceal intrusions into critical infrastructure networks. Black Lotus Labs said the botnet had been active since 2020, at one point exceeding 60,000 live nodes and compromising more than 200,000 routers, NAS devices, IP cameras, and other internet-exposed systems. The operation used a multi-tier architecture and a custom Mirai-derived implant called `Nosedive`, which enabled remote command execution, file transfer, and retained **DDoS** capability while using in-memory execution and anti-forensics techniques. Researchers linked the activity to targeting in the United States and Taiwan across government, military, telecommunications, higher education, defense industrial base, and IT sectors, alongside scanning and likely exploitation attempts against **Atlassian Confluence** and **Ivanti Connect Secure** appliances. The **FBI** and Department of Justice said they disrupted the botnet in a court-authorized operation that removed malware from infected routers, and officials later said the action effectively dismantled infrastructure used by Chinese operators to hide follow-on hacking. Subsequent reporting said the botnet exploited dozens of vulnerabilities across edge and IoT products, with VulnCheck identifying **66 actively targeted CVEs** tied to the campaign, far more than were listed in CISA’s Known Exploited Vulnerabilities catalog. Additional reporting also pointed to corporate links around **Integrity Technology**, described as connected to Flax Typhoon and tied through competitive, partner, and client relationships to **i-SOON**, adding to the picture of a broader Chinese intrusion ecosystem supporting espionage and potential disruptive operations.
Jun 29, 2026
The FBI said it remotely removed **PlugX malware** from more than **4,200 U.S. computers** after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at **4,258 systems**, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks. U.S. authorities later expanded the crackdown by unsealing charges against **12 Chinese nationals** and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with **Silk Typhoon** (also tracked as **APT27** and formerly **Hafnium**). Prosecutors alleged that China’s security services used contractors, including **i-Soon**, to hack U.S. government agencies and other prominent targets, charging state customers roughly **$10,000 to $75,000 per compromised email inbox** and tying the activity to intrusions spanning more than a decade, including the **U.S. Treasury** breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Jun 29, 2026
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026