US Authorities Seize Domains for Flax Typhoon Hacking Tools
The Justice Department and FBI announced the seizure of two hacking tools linked to the Chinese government-associated threat group Flax Typhoon, marking a coordinated effort to disrupt cyber operations targeting critical infrastructure worldwide. The tools, Microscan and FishHub, were developed and distributed by Integrity Technology Group, a China-based company that has faced repeated U.S. sanctions and takedown actions due to its ties to state-linked cyber actors.
The seizures were carried out under court authorization in the Western District of Pennsylvania, with the DOJ and FBI unsealing related documents on Thursday. This action was paired with a joint cybersecurity advisory issued by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA), warning of ongoing threats from Chinese government-affiliated actors.
Advisory Details Global Threat from Flax Typhoon and Integrity Tech
The advisory stated that Chinese government-linked cyber threat actors, enabled by Integrity Technology Group, are deploying automated scanning tools, large-scale botnets, and manual exploitation techniques to steal sensitive data from organizations globally, including U.S. critical infrastructure sectors. These actors exploit vulnerabilities using tools like Microscan, conduct cross-site scripting attacks, and employ password spraying against Microsoft Exchange servers.
To maintain access, attackers use VPN software for persistence and deploy scripts to exfiltrate emails and credentials. The advisory emphasized that these activities are part of a broader strategy to position themselves within critical infrastructure and operational technology (OT) networks for potential future disruption.
Tools Targeted Critical Infrastructure Across Multiple Sectors
According to the FBI and DOJ, Microscan — a vulnerability scanning tool — has been used against a range of high-value targets, including a South Carolina power company, airports in Japan and Poland, critical infrastructure firms, and universities in Taiwan. The tool leverages a Mirai-variant botnet composed of compromised Internet-of-Things (IoT) devices to scan for exploitable weaknesses.
FishHub, the second seized tool, functions as a spearphishing platform that delivers malware to victim networks after gaining initial access through deceptive emails. Victims of FishHub have included Taiwanese universities, highlighting the tool’s use in espionage campaigns targeting academic and research institutions.
Officials Stress Action Against Both Actors and Enablers
Chris Butera, acting executive assistant director for cybersecurity at CISA, warned that Chinese government-affiliated actors continue to embed themselves within critical infrastructure and OT systems, aiming to disrupt essential functions at a time of their choosing. He stressed the importance of defending these environments against persistent intrusion.
Brett Leatherman, head of the FBI’s Cyber Division, reinforced the agency’s strategy under the FBI Cyber Strategy to pursue not only the threat actors directly conducting attacks but also the enterprises that enable them. He identified Integrity Technology Group as one such enterprise — a China-based company with government ties that acquires or develops cyber tools and hosts infrastructure for malicious actors operating worldwide.
The domain seizures represent a continuation of U.S. efforts to dismantle the technical infrastructure supporting state-linked cyber threats, following prior sanctions and takedown operations against Integrity Technology Group in 2024. By removing access to Microscan and FishHub, authorities aim to degrade the capabilities of Flax Typhoon and similar groups conducting global cyber campaigns.
Source: CyberScoop