A joint takedown operation last year sought to disrupt Flax Typhoon’s compromise of hundreds of thousands of devices.

Beijing's hackers are also using an open-source VPN tool for persistence.

Flax Typhoon targeted critical infrastructure in the U.S. and abroad, and Black Lotus Labs researchers observed a “large scanning effort” targeting U.S. military and government.