US seizes domains behind Chinese contractor's MicroScan and FishHub hacking tools
The Justice Department and FBI seized seven domains used to run MicroScan and FishHub, intrusion tools that China-based Integrity Technology Group used in Flax Typhoon operations against US and foreign critical infrastructure, from a South Carolina power company to Taiwanese universities. Agencies from seven countries published a joint advisory, and CISA added five old flaws the group exploits to its Known Exploited Vulnerabilities catalog.
On October 8, the Justice Department and FBI announced court-authorized seizures, including seven domains, that cut off access to MicroScan and FishHub. According to court documents unsealed in the Western District of Pennsylvania, staff at Integrity Technology Group, a China-based company with Chinese government contracts, operated the tools as part of the activity known as Flax Typhoon.
MicroScan was used, partly through a Mirai-based botnet of infected devices, to scan victim networks for vulnerabilities that Integrity Tech's clients would later exploit. Targets included a South Carolina power company, a multinational NGO, Japanese and Polish airports, Taiwanese natural gas and power companies, and two Taiwanese universities. FishHub supported spear phishing: after an initial compromise it downloaded malware, delivered through five of the seized domains, that gave clients remote access or hunted for specific files to steal. Confirmed FishHub victims include about 20 Taiwanese universities. It is the department's second public disruption of Integrity Tech, after the September 2024 court-authorized disruption of its Mirai botnet of more than 200,000 consumer devices.
Alongside the seizures, agencies from the US, UK, Australia, Canada, Japan, New Zealand and Spain published joint advisory AA26-281A. It describes MicroScan as a Python web application with more than 1,300 penetration-testing scripts, and details password spraying against Microsoft Exchange, persistence through SoftEther VPN, and theft of email and credentials, in some cases from government, law enforcement and healthcare organizations in Southeast Asia. The advisory lists eight exploited CVEs; five of them, flaws in ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE Docs and Strapi dating from 2015 to 2023, were added to CISA's Known Exploited Vulnerabilities catalog the same day.
Sources
- US Attorney's Office, WDPA: Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers justice.gov
- FBI, CISA, NSA and partners: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (AA26-281A, PDF) ic3.gov
- CISA Known Exploited Vulnerabilities catalog data (cisagov/kev-data) github.com