Beijing's hackers are also using an open-source VPN tool for persistence.

Flax Typhoon targeted critical infrastructure in the U.S. and abroad, and Black Lotus Labs researchers observed a “large scanning effort” targeting U.S. military and government.