DOJ and FBI Seize Flax Typhoon-Linked Hacking Tools Microscan and FishHub

The U.S. Department of Justice and the Federal Bureau of Investigation have seized two command-and-control hacking tools, Microscan and FishHub, which are linked to the threat actor known as Flax Typhoon. According to CyberScoop, the seizures were executed as part of a coordinated action involving multiple federal agencies.

The seized tools are allegedly operated by Integrity Tech, a Chinese firm. The action was accompanied by a security warning issued jointly by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA). This coordinated effort highlights the ongoing threat posed by state-sponsored actors targeting U.S. infrastructure and intellectual property.

Context and Background

Flax Typhoon is a persistent threat actor known for conducting cyber espionage and intrusion campaigns. The involvement of Integrity Tech suggests a direct link between the commercial entity and the malicious infrastructure used by the group. The seizure of Microscan and FishHub disrupts the operational capabilities of the group, potentially hindering their ability to maintain persistent access to compromised networks.

The joint warning from the FBI, CISA, and NSA serves as an alert to organizations that may have been targeted by these tools. By publicizing the seizure and the associated indicators of compromise, the agencies aim to help defenders identify and mitigate similar threats. The coordination between law enforcement and cybersecurity agencies underscores the severity of the threat and the commitment to dismantling the infrastructure used by foreign adversaries.

Who Is Affected

Organizations that have been targeted by Flax Typhoon are the primary victims of this campaign. The use of Microscan and FishHub indicates that these groups have been actively scanning for vulnerabilities and establishing command-and-control channels. Any entity that has interacted with infrastructure linked to Integrity Tech or exhibits signs of compromise by Flax Typhoon should consider itself at risk.

The warning from the federal agencies is directed at security professionals and IT administrators who need to assess their environments for signs of these specific tools. Given the state-sponsored nature of the threat, critical infrastructure sectors and technology firms may be particularly vulnerable. The seizure does not guarantee that all instances of the tools have been removed, leaving residual risk for those who were previously compromised.

What should you do?

Security teams should review network logs and threat intelligence feeds for any references to Microscan, FishHub, or Integrity Tech. Organizations should also monitor for unusual outbound traffic or unauthorized command-and-control communications that may indicate the presence of these tools. If indicators of compromise are found, immediate incident response procedures should be initiated to contain and eradicate the threat.

What to do and how to stay safe: Flax Typhoon

• Review network traffic and logs for indicators associated with Microscan and FishHub.
• Check for any connections to infrastructure linked to Integrity Tech.
• Monitor for unusual command-and-control activity that may suggest compromise.
• Follow guidance from the FBI, CISA, and NSA on mitigating Flax Typhoon threats.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What hacking tools were seized by the DOJ and FBI?

The DOJ and FBI seized the Microscan and FishHub command-and-control tools.

Which threat actor is linked to these tools?

The tools are linked to the Flax Typhoon threat actor.

Which Chinese firm is allegedly operating these tools?

The tools are allegedly operated by the Chinese firm Integrity Tech.