1818: "The FBI Takes Down a Chinese Hacking Network"

Oct 27

Written by JC

Interesting Things with JC #1818: "The FBI Takes Down a Chinese Hacking Network"

The FBI seized seven internet domains linked to Chinese state-sponsored hackers after investigators uncovered tools targeting an American power company, international airports, and Taiwanese universities. The operation followed an earlier disruption involving more than 200,000 compromised consumer devices, including routers and security cameras.

Curriculum - Episode Anchor

Series: Interesting Things with JC™
Episode Title: The FBI Takes Down a Chinese Hacking Network
Episode Number: 1818
Host: JC
Date of Historical Event: October 8, 2026
Audience: Grades 9–12, introductory college, homeschool, and lifelong learners
Subject Area: Cybersecurity, computer science, U.S. history, government, international relations, digital citizenship, media literacy, and critical infrastructure protection
Instructional Duration: 45–60 minutes, with optional extensions
Instructional Format: Audio-first, inquiry-based learning, primary-source analysis, collaborative discussion, and written assessment
Prerequisites: Basic familiarity with internet-connected devices and computer networks. No programming experience required.
Curriculum Access: Free educational resources available at JimConnors.net. No login or paywall.

Lesson Overview

Lesson Summary

On October 8, 2026, the U.S. Department of Justice announced the seizure of seven internet domains associated with tools used in Chinese state-linked cyber operations. Federal authorities connected the infrastructure to Integrity Technology Group, a Beijing-based company, and to activity associated with Flax Typhoon.

The operation followed a September 2024 disruption involving a botnet of more than 200,000 compromised consumer devices.

Students examine how cyber espionage operates, how compromised equipment can support larger operations, what federal authorities can accomplish through infrastructure seizures, and why careful distinctions between attempted and successful intrusions matter.

Essential Question: How can everyday internet-connected devices become part of international cyber espionage, and what can governments and individuals do to reduce the threat?

Learning Objectives

By the end of the lesson, students will be able to:

Identify the principal organizations, technologies, and events involved in the 2024 and 2026 operations.
Explain how botnets, phishing, malware, and vulnerability scanning function at a conceptual level.
Distinguish reconnaissance, attempted compromise, confirmed intrusion, and infrastructure disruption.
Analyze how compromised consumer devices can be exploited in operations against critical infrastructure.
Evaluate the capabilities and limitations of government cybersecurity interventions.
Apply evidence-based reasoning when assessing claims about state-sponsored hacking.
Recommend practical defensive measures for individuals and organizations.

Success Criteria

Students demonstrate mastery when they can accurately explain the timeline, define at least six technical terms, distinguish confirmed facts from allegations, and construct a supported cybersecurity risk assessment.

Student Relevance

Home routers, connected cameras, gaming systems, and other networked devices are part of daily life. Understanding how such equipment can be compromised helps students make informed decisions about their own digital security.

Real-World Connection

The case connects household technology to national security, public utilities, international transportation, university research, and the legal authorities used in cyber investigations.

Key Vocabulary

Cyber Espionage: Unauthorized access to digital systems for obtaining confidential information, often for intelligence purposes.
Flax Typhoon: A name used by U.S. authorities and cybersecurity researchers for a Chinese state-linked cyber threat group. The term describes attributed activity, not necessarily every individual involved.
Botnet (BOT-net): A collection of compromised internet-connected devices controlled or coordinated without their owners' authorization.
Malware (MAL-wair): Software designed to perform harmful or unauthorized actions.
Mirai (mee-RYE): A malware family known for infecting vulnerable internet-connected devices and enabling botnet activity.
Phishing (FISH-ing): Deceptive electronic communications intended to trick recipients into revealing information or performing unsafe actions.
Spear Phishing: A targeted phishing attempt tailored to a particular individual or organization.
Vulnerability Scanning: Testing or examining systems to identify potentially exploitable weaknesses.
Reconnaissance (rih-KON-uh-suhns): Gathering information about systems, networks, or potential targets before further activity.
Domain Seizure: A legally authorized action transferring control of an internet domain or otherwise preventing its previous operator from using it.
Command and Control: Systems used by attackers to communicate with and direct compromised devices.
Critical Infrastructure: Systems and assets essential to important societal functions, including energy, water, transportation, and communications.
Attribution: The process of identifying the person, organization, or government believed responsible for a cyber operation.
Indicators of Compromise: Technical evidence, such as malicious addresses, domains, files, or system behaviors, that may help defenders identify suspicious activity.
Digital Forensics: The systematic collection, preservation, and examination of digital evidence.

Vocabulary Activity

Students select five terms and create a concept map showing how the terms relate to one another. Each connection must include a short explanation.

Narrative Core

Open

The FBI's October 2026 operation involved seven internet domains and an investigation extending across multiple countries. Earlier related activity had involved equipment owned by unsuspecting internet users.

Info

Federal authorities identified tools associated with Flax Typhoon and Integrity Technology Group. The tools were described as supporting vulnerability scanning and targeted phishing activity.

Details

Microscan searched for weaknesses in computer networks, while FishHub supported targeted phishing operations. Investigators also connected the broader case to an earlier botnet disruption involving more than 200,000 compromised consumer devices.

Reflection

The operation demonstrates how cybersecurity investigations extend beyond individual computers. A router or security camera may be used without its owner's knowledge, while a domain seizure can interrupt part of an adversary's infrastructure without necessarily ending the broader operation.

Closing

The case raises questions about device security, responsibility for protecting shared networks, international law enforcement cooperation, and the continuing challenge of attributing cyber operations accurately.

Transcript

Interesting Things with JC #1818

"The FBI Takes Down a Chinese Hacking Network"

In October 2026, the FBI seized seven internet domains connected to a Chinese hacking operation. Its targets included an American power company, international airports, and universities across Taiwan. But federal authorities had already confronted related hacking infrastructure two years earlier.

On October 8, the Justice Department announced the disruption of two hacking tools associated with Flax Typhoon, a cyber espionage group linked by American authorities to the Chinese government.

Investigators identified Integrity Technology Group, a Beijing-based company holding Chinese government contracts, as the operator.

Its first tool, Microscan, searched networks for vulnerabilities using more than 1,300 testing scripts. Targets included a South Carolina power company, airports in Japan and Poland, and Taiwan's energy infrastructure. Scanning didn't necessarily mean those networks were breached.

The second tool, FishHub, supported targeted phishing attacks. Once attackers gained access, additional malware could establish remote connections or steal sensitive files.

Approximately 20 Taiwanese universities were confirmed victims.

In September 2024, investigators disrupted a related botnet containing more than 200,000 infected consumer devices worldwide, including routers, security cameras, and video recorders.

The malware allowed hackers to exploit ordinary internet connections, concealing their activities behind equipment belonging to unsuspecting owners.

Two years later, investigators targeted the infrastructure supporting Microscan and FishHub.

With court authorization, authorities seized seven domains, disrupting access to the hacking tools. Federal agencies also published technical indicators to help organizations identify related malicious activity.

China rejected the American accusations, maintaining that it opposes hacking.

The FBI didn't claim to have eliminated Flax Typhoon. The seizures disrupted specific capabilities, while the broader threat remained.

And the equipment used in such operations isn't always hidden inside a government facility. Sometimes it's an ordinary router or security camera, doing something its owner never authorized.

These are interesting things, with JC.

Student Worksheet

Part A — Comprehension

Answer using complete sentences and specific evidence from the episode.

What action did the FBI announce on October 8, 2026?
Which Chinese company did American authorities associate with the hacking infrastructure?
What was the primary function of Microscan?
How did FishHub differ from Microscan?
Why is identifying a scanning target different from confirming a successful intrusion?
Approximately how many Taiwanese universities were identified as confirmed victims?
What happened during the September 2024 botnet disruption?
Why might hackers use compromised household equipment rather than computers directly registered to them?

Part B — Analysis

Construct a timeline connecting the September 2024 and October 2026 operations. Identify what was disrupted in each event.
Explain how a compromised home router could indirectly support an operation against a power company.
Why might seizing seven internet domains disrupt a hacking operation without permanently eliminating the organization responsible?
Distinguish the following statements: "A network was scanned," "A network was compromised," and "Sensitive information was stolen."
What evidence would investigators need before confidently attributing a cyber operation to a particular organization or government?
Why is international cooperation particularly important in investigations involving infrastructure and victims across national borders?

Part C — Critical Thinking

A headline states, "Chinese Hackers Breached Every Airport They Targeted." Based on the episode, explain why that headline would be misleading.
A home security camera continues functioning normally even though investigators suspect it was part of a botnet. Explain how both conditions could exist.
Evaluate the statement: "If the FBI seized the hackers' domains, the cybersecurity threat is over." Identify the unsupported assumption.

Part D — Reflection

Who should bear responsibility for securing internet-connected devices: manufacturers, owners, internet providers, governments, or some combination? Defend your answer.
What are the advantages and limitations of publicly identifying a foreign government as responsible for a cyber operation?
Identify three changes that would improve the security of a typical home network and explain the purpose of each.

Difficulty Scaling

Level 1 — Foundational: Complete questions 1–8 and identify five vocabulary terms.
Level 2 — Intermediate: Complete questions 1–14 and construct a supported timeline.
Level 3 — Advanced: Complete all questions and evaluate competing explanations using at least two credible sources.

Student Output

Submit a completed worksheet and a 150–250-word analysis explaining how the two FBI operations differed and what they reveal about the limits of cybersecurity enforcement.

Academic Integrity Guidance

Use original language, distinguish source claims from personal conclusions, and identify all external references. AI-assisted research, where permitted by the instructor, must be checked against primary sources. Students should not perform unauthorized scans or attempt to access systems they do not own or have permission to test.

Teacher Guide

Quick Start

Begin with the podcast audio. Ask students to identify what investigators actually accomplished before introducing the technical vocabulary. Emphasize that the lesson examines documented government actions and attributed cyber activity, not assumptions about individuals based on nationality.

Pacing Guide — Audio First

0–5 minutes: Bell ringer and initial predictions.
5–9 minutes: Play the episode and collect three key observations.
9–17 minutes: Teach essential vocabulary and the investigative timeline.
17–30 minutes: Student worksheet and evidence classification.
30–40 minutes: Collaborative case analysis.
40–50 minutes: Quiz and discussion.
50–60 minutes: Written assessment and exit ticket.

Bell Ringer

Present the following scenario:

"A family's internet-connected security camera is functioning normally. Investigators later discover that malicious software has been using the device to send network traffic elsewhere."

Ask students whether the camera's apparent functionality proves it is secure. Require them to explain their reasoning.

Audio Guidance

Play the episode without interruption. On the second listening, ask students to record:

One government action.
One technical method.
One confirmed consequence.
One unresolved question.

Audio Fallback

If playback is unavailable, provide the transcript for individual or paired reading. Allow approximately five minutes and preserve the same comprehension and analysis requirements.

Materials

Episode audio or transcript.
Student worksheet.
Internet access for primary-source research, where available.
Whiteboard or shared document.
Optional printed timeline and vocabulary cards.
Quiz and assessment rubric.

Vocabulary Strategy

Introduce botnet, phishing, scanning, and domain seizure before discussing the investigative findings. Have students explain each term using a nontechnical analogy, then refine the explanation for accuracy.

Common Misconceptions

Misconception: Scanning a network proves it was hacked.
Correction: Scanning identifies or investigates potential weaknesses; it does not establish successful unauthorized access.
Misconception: Every compromised device stops working.
Correction: Malware can operate alongside legitimate functions.
Misconception: A domain seizure permanently destroys a hacking group.
Correction: Seizures can disrupt particular infrastructure while other capabilities remain.
Misconception: All cyberattacks involve stealing information.
Correction: Operations may involve reconnaissance, disruption, espionage, or other objectives.
Misconception: Attribution always provides absolute certainty.
Correction: Attribution depends on evidence and may involve uncertainty, competing interpretations, and intelligence that is not publicly disclosed.

Classroom Activity — Evidence Classification

Provide students with these statements:

A. Investigators seized seven domains.

B. A South Carolina power company was identified as a scanning target.

C. Every targeted airport was successfully breached.

D. The 2024 botnet included more than 200,000 compromised devices.

E. The October 2026 operation permanently ended all Flax Typhoon activity.

F. Approximately 20 Taiwanese universities were identified as confirmed victims.

Students classify each statement as:

Supported by the reported evidence.
Unsupported or overstated.
Requiring additional evidence or qualification.

Students must justify each classification.

Collaborative Activity — Map the Operation

Divide the class into four groups:

Group 1 — Investigators: Identify the FBI's legal and technical actions.
Group 2 — Network Defenders: Explain how suspicious activity might be detected.
Group 3 — Device Owners: Recommend measures to protect household equipment.
Group 4 — Evidence Reviewers: Distinguish confirmed facts from attributed or disputed claims.

Each group presents a two-minute summary. The class then constructs a shared diagram linking devices, malicious infrastructure, potential targets, investigators, and defensive responses.

Discussion Prompts

What makes cyber espionage different from conventional theft?
Why might an attacker prefer compromised equipment located in another country?
How should governments communicate uncertainty in public cybersecurity announcements?
What can ordinary device owners reasonably be expected to understand?
When is public disclosure of technical threat information beneficial?

Formative Checkpoints

Students correctly distinguish scanning from compromise.
Students identify the difference between the 2024 and 2026 operations.
Students explain why domain seizures have limited but meaningful effects.
Students provide evidence rather than assumptions when discussing attribution.

Differentiation

Additional Support: Provide a vocabulary bank, simplified timeline, and sentence starters.
Advanced Learners: Analyze technical advisories and compare law-enforcement disruption with long-term network defense.
English Learners: Preteach technical vocabulary, permit bilingual notes, and provide short explanatory definitions.
Accessibility: Supply the full transcript, written instructions, adjustable reading time, and alternatives to oral presentation.

Assessment Differentiation

Students may demonstrate understanding through a written response, recorded explanation, annotated diagram, or instructor-approved presentation, provided they meet the same evidence and reasoning standards.

Time Flexibility

30 minutes: Audio, vocabulary, selected worksheet questions, exit ticket.
45 minutes: Audio, worksheet, group discussion, quiz.
60 minutes: Full lesson and assessment.
90 minutes: Add primary-source comparison and a short research presentation.

Substitute Readiness

The lesson is self-contained. A substitute can distribute the transcript, administer the worksheet, supervise the evidence-classification activity, and use the answer key for review.

Engagement Strategy

Use the contrast between an ordinary household device and an international cyber operation to generate questions. Avoid sensationalized hacking demonstrations or simulations involving real systems.

Extensions

Research the 2016 emergence of Mirai and its influence on botnet security discussions.
Compare the September 2024 and October 2026 FBI operations.
Examine the responsibilities of manufacturers regarding default passwords and security updates.
Research how critical infrastructure organizations identify and manage cyber risks.
Create a consumer cybersecurity awareness guide based on CISA recommendations.
Investigate how international legal jurisdictions complicate cybercrime enforcement.

Cross-Curricular Connections

Computer Science: Network architecture, software vulnerabilities, and malware.
Civics: Federal investigative authority, court orders, and international cooperation.
History: Development of internet-connected devices and state-linked cyber operations.
Geography: International infrastructure and cross-border digital activity.
English Language Arts: Evidence evaluation, source comparison, and argument writing.
Ethics: Privacy, security responsibilities, and public attribution.

Social-Emotional Learning Connection

Encourage responsible digital behavior without creating unnecessary fear. Emphasize that cybersecurity improves through practical precautions, evidence-based decisions, and cooperation.

Skill Value Emphasis

Students practice technical literacy, source evaluation, analytical reasoning, risk assessment, and responsible citizenship.

Answer Key — Student Worksheet

The FBI and DOJ announced the seizure of seven internet domains associated with hacking tools.
Integrity Technology Group.
Microscan searched networks for vulnerabilities.
FishHub supported targeted phishing activity rather than primarily scanning for vulnerabilities.
Scanning does not prove unauthorized access or successful exploitation.
Approximately 20 universities.
Federal authorities disrupted a botnet involving more than 200,000 compromised consumer devices.
Compromised equipment can conceal the attackers' actual infrastructure and complicate attribution.
The 2024 operation targeted a compromised-device botnet; the 2026 operation targeted domains associated with hacking tools.
A compromised router could relay malicious traffic or conceal the source of suspicious network activity.
Operators may retain other infrastructure, tools, personnel, and methods.
Scanning is reconnaissance; compromise involves unauthorized access or control; theft requires evidence of information being taken.
Relevant evidence might include infrastructure records, malware analysis, operational patterns, financial links, communications, and corroborating intelligence.
Evidence, infrastructure, and victims may be located in different legal jurisdictions.
The episode identifies scanning targets but does not establish that every airport was breached.
Malware can operate in the background while legitimate device functions continue.
The statement incorrectly assumes that disrupting particular domains eliminates the entire threat organization.
Strong answers discuss shared responsibility and practical limits.
Strong answers address deterrence, transparency, evidence quality, diplomatic consequences, and uncertainty.
Accept measures such as changing default credentials, installing updates, disabling unnecessary remote access, and separating less-trusted devices from important systems.

Quiz

Instructions: Select the best answer. Each question is worth one point.

What did federal authorities announce on October 8, 2026?
A. The permanent shutdown of the entire internet in China
B. The seizure of seven internet domains
C. The arrest of every member of Flax Typhoon
D. The replacement of all American routers
Which organization was identified as operating the tools?
A. Integrity Technology Group
B. NASA
C. The International Telecommunication Union
D. The Federal Aviation Administration
What was Microscan primarily used for?
A. Manufacturing cameras
B. Encrypting university records
C. Searching networks for vulnerabilities
D. Broadcasting television signals
FishHub was associated with which activity?
A. Targeted phishing
B. Weather forecasting
C. Aircraft navigation
D. Satellite construction
What is a botnet?
A. A government-only computer network
B. A collection of compromised devices
C. A type of computer monitor
D. A physical telecommunications cable
Approximately how many devices were involved in the related 2024 botnet disruption?
A. 200
B. 2,000
C. 20,000
D. More than 200,000
Which statement is most accurate?
A. Scanning always proves a breach.
B. Scanning and confirmed compromise are identical.
C. Scanning may occur without a successful breach.
D. Scanning always results in stolen information.
Why might attackers exploit household routers?
A. To conceal malicious activity behind legitimate internet connections
B. To improve household television reception
C. To replace electricity meters
D. To increase internet subscription prices
What is one limitation of domain seizures?
A. They can never affect malicious activity.
B. They automatically eliminate all malware worldwide.
C. Operators may continue using other infrastructure.
D. They permanently disable every internet-connected device.
Which is the most responsible response to suspicious device activity?
A. Ignore security updates.
B. Publish private passwords.
C. Investigate using trusted security guidance and appropriate professional support.
D. Attempt unauthorized access to unrelated networks.

Teacher Quiz Key: 1-B, 2-A, 3-C, 4-A, 5-B, 6-D, 7-C, 8-A, 9-C, 10-C.

Suggested Mastery Threshold: 8 of 10 correct, with additional review for students unable to distinguish reconnaissance from confirmed intrusion.

Assessment

Summative Task — Cybersecurity Case Analysis

Students prepare a 400–600-word report or equivalent presentation answering:

How did the FBI's 2024 and 2026 operations disrupt different components of a related cyber threat, and what limitations remained?

The report must include:

An accurate chronology of both operations.
An explanation of the roles of Microscan, FishHub, and compromised consumer devices.
A distinction between scanning, confirmed compromise, and attribution.
An analysis of the benefits and limitations of infrastructure seizures.
At least three practical cybersecurity recommendations.
At least two credible references, including one primary government source.

Scoring Rubric — 20 Points

Factual Accuracy — 5 points: Correct chronology, organizations, technologies, and investigative outcomes.
Technical Understanding — 5 points: Accurate explanation of cybersecurity concepts.
Evidence and Reasoning — 5 points: Claims supported by appropriate sources and qualifications.
Communication — 3 points: Clear organization, readable language, and coherent conclusions.
Citation and Academic Integrity — 2 points: Proper source identification and original analysis.

Performance Bands

18–20: Advanced mastery.
15–17: Proficient.
12–14: Developing.
0–11: Additional instruction recommended.

Open-Ended Assessment Questions

Why are compromised consumer devices valuable to sophisticated cyber operators?
What makes state-sponsored cyber attribution difficult?
Why is interrupting infrastructure different from eliminating a threat?
How can the public distinguish a documented cyber incident from an exaggerated headline?

Exit Ticket

Before leaving, students complete:

One confirmed fact from the investigation.
One cybersecurity term they can now explain.
One action they can take to improve device security.
One question requiring further investigation.

Standards Alignment

NGSS — Science and Engineering Practices

Engaging in Argument from Evidence: Students distinguish documented findings from unsupported claims and defend conclusions using source material.
Obtaining, Evaluating, and Communicating Information: Students compare investigative statements, technical advisories, and reporting for accuracy and relevance.
Analyzing and Interpreting Data: Students interpret numerical information and incident classifications in the context of cyber investigations.

These are practice-level connections; the lesson does not independently establish full alignment to a specific NGSS performance expectation.

Common Core State Standards — Reading

CCSS.ELA-LITERACY.RI.9-10.1 — Cite strong and thorough textual evidence: Students support explanations of the investigation with specific source details.
CCSS.ELA-LITERACY.RI.9-10.8 — Delineate and evaluate an argument and specific claims: Students identify unsupported conclusions about scanning, breaches, and attribution.
CCSS.ELA-LITERACY.RI.11-12.7 — Integrate and evaluate multiple sources of information presented in different media or formats: Students compare audio, government documents, and technical reporting.

Common Core State Standards — Writing

CCSS.ELA-LITERACY.W.9-10.1 — Write arguments to support claims: Students defend cybersecurity recommendations using evidence.
CCSS.ELA-LITERACY.W.9-10.7 — Conduct short as well as more sustained research projects: Students investigate documented cyber operations.
CCSS.ELA-LITERACY.W.11-12.8 — Gather relevant information from multiple authoritative print and digital sources: Students assess source credibility and provide citations.

C3 Framework — College, Career, and Civic Life

D2.Civ.4.9-12: Explain how governmental powers and responsibilities are distributed, shared, and limited in a constitutional democracy.
D3.1.9-12: Gather relevant information from multiple sources while using origin, authority, structure, context, and corroborative value to guide selection.
D4.1.9-12: Construct arguments using precise claims and evidence from multiple sources.

CSTA K–12 Computer Science Standards

3A-NI-06: Recommend security measures to address various scenarios based on factors such as efficiency, feasibility, and ethical impacts.
3A-IC-24: Evaluate the ways computing impacts personal, ethical, social, economic, and cultural practices.

Career Readiness Competencies

Critical thinking and evidence evaluation.
Digital literacy and cybersecurity awareness.
Ethical decision-making.
Technical communication.
Collaborative problem-solving.
Risk identification and mitigation.

Alignment Note: Standards are selected for relevant instructional skills. Teachers should confirm local adoption, grade-band requirements, and assessment expectations.

Show Notes

Episode Summary

On October 8, 2026, the FBI and Justice Department announced the seizure of seven internet domains associated with hacking tools linked to Chinese state-sponsored cyber activity.

The investigation identified Microscan, a vulnerability-scanning platform, and FishHub, a tool supporting targeted phishing attacks. American authorities connected the operation to Integrity Technology Group and activity associated with Flax Typhoon.

The announcement followed a September 2024 disruption involving more than 200,000 compromised consumer devices.

This episode explores how international cyber operations can exploit ordinary technology, why critical infrastructure attracts attention, and how investigators disrupt malicious infrastructure without necessarily eliminating the organizations behind it.

Key Takeaways

Cyber espionage can involve both sophisticated tools and ordinary consumer equipment.
Vulnerability scanning does not automatically establish successful compromise.
Botnets can conceal malicious activity behind legitimate internet connections.
Domain seizures can interrupt operational infrastructure but may not eliminate an adversary.
Cybersecurity requires coordinated action by individuals, manufacturers, organizations, and governments.

Suggested Discussion Question: What does the FBI's investigation reveal about the relationship between household technology and national cybersecurity?

Episode: Interesting Things with JC #1818 — "The FBI Takes Down a Chinese Hacking Network"

Host: JC

Availability: Podcast audio, transcript, and open educational curriculum through JimConnors.net.

Curriculum Use: Suitable for secondary classrooms, introductory college courses, homeschool instruction, and independent study.

References

U.S. Department of Justice. (2026, October 8). Justice Department and FBI seize vulnerability scanning and spear phishing tools. U.S. Attorney's Office, Western District of Pennsylvania. https://www.justice.gov/usao-wdpa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools
U.S. Department of Justice. (2024, September 18). Court-authorized operation disrupts worldwide botnet used by People's Republic of China state-sponsored hackers. https://www.justice.gov/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state
Federal Bureau of Investigation. (2024, September). PRC-linked actors' botnet of 200,000 devices disrupted. FBI public reporting and associated advisories. https://www.fbi.gov/
MITRE. (n.d.). MITRE ATT&CK: Enterprise tactics and techniques. https://attack.mitre.org/
NGSS Lead States. (2013). Next Generation Science Standards: For states, by states. National Academies Press. https://www.nextgenscience.org/
Common Core State Standards Initiative. (2010). English language arts standards. https://www.thecorestandards.org/ELA-Literacy/
National Council for the Social Studies. (2013). The College, Career, and Civic Life (C3) Framework for Social Studies State Standards. https://www.socialstudies.org/standards/c3
Computer Science Teachers Association. (2017). CSTA K–12 computer science standards. https://csteachers.org/k12standards/

Source Evaluation Note

The October 2026 case is presented using the U.S. government's investigative account. Statements attributing operations to Chinese state-linked actors should be understood as the conclusions or allegations of U.S. authorities unless independently established. Network scanning, attempted exploitation, confirmed compromise, and data theft are separate evidentiary categories.

The 2024 and 2026 operations are related but distinct. Their technical methods, targets, and investigative outcomes should not be treated as interchangeable.

Educational Publication: Interesting Things with JC™

FBI Chinese hacking network 2026Flax Typhoon FBI operationIntegrity Technology Group China hackingFBI seven domain seizures October 2026Microscan FishHub malwareChinese state-sponsored cyber espionageFBI botnet takedown 2024China critical infrastructure cyberattacksCompromised routers and security camerasFBI cybersecurity investigationCybersecurity and cyber espionage lesson plansHistory of Chinese state-sponsored hacking operationsHow botnets and compromised internet devices workCritical infrastructure cybersecurity classroom activitiesDigital citizenship and phishing awareness curriculum

JC https://jimconnors.org