FBI Seizes Seven Domains Used by Chinese Hackers to Breach Critical Infrastructure
The FBI disrupted Flax Typhoon’s MicroScan and FishHub tools, seizing domains linked to a Chinese firm targeting global critical infrastructure.
Key points
- The FBI seized seven domains used by the Chinese state-sponsored group Flax Typhoon.
- The domains supported MicroScan and FishHub, tools used to breach critical infrastructure.
- The hackers are linked to Integrity Technology Group, a China-based company with government contracts.
The Federal Bureau of Investigation has seized seven internet domains used by Chinese state-sponsored hackers known as Flax Typhoon. This action disrupts the group’s ability to operate two specific hacking tools, MicroScan and FishHub, which were used to breach critical infrastructure and other organizations worldwide.
According to a seizure notice from the US Department of Justice, the individuals behind these operations work for Integrity Technology Group, a company based in China. The notice states that Integrity Tech holds contracts with the Chinese government. The FBI’s action targets the infrastructure supporting these tools, which had been used to scan and hack into US and foreign critical infrastructure systems.
Context and Background
Flax Typhoon is a threat actor attributed to Chinese state-sponsored activities. According to reports from BleepingComputer and Help Net Security, the group utilized MicroScan and FishHub to conduct cyberattacks against critical infrastructure and other organizations in the United States and abroad. SecurityWeek reported that Flax Typhoon and other Advanced Persistent Threats (APTs) used these tools to scan and compromise critical infrastructure assets.
The seizure of the seven domains represents a significant disruption to the group’s operational capabilities. By taking control of the domains, the FBI has effectively cut off the command-and-control channels or distribution points associated with these specific tools. The US Department of Justice highlighted the role of Integrity Technology Group in facilitating these attacks, noting the company’s ties to the Chinese government.
Who Is Affected
The attacks impacted critical infrastructure sectors in the US and other countries. While the source material does not list specific victim organizations, it confirms that the breaches targeted critical infrastructure and other entities globally. The use of MicroScan and FishHub allowed the attackers to scan for vulnerabilities and gain unauthorized access to these high-value targets.
Security professionals should note that the disruption of these specific tools does not necessarily mean all activity by Flax Typhoon has ceased. The group may employ other tools or methods. However, the seizure of these domains removes the specific infrastructure associated with MicroScan and FishHub.
What should you do?
Organizations should monitor for any residual activity linked to the seized domains or the tools MicroScan and FishHub. Since no patch or fix was mentioned in the source material, the focus should be on detection and exposure reduction. Security teams should review logs for any connections to the affected domains or indicators of compromise associated with these tools.
What to do and how to stay safe: Flax Typhoon
- Review network logs for any historical connections to the seven seized domains or known indicators associated with MicroScan and FishHub.
- Scan internal systems for signs of unauthorized access or scanning activity consistent with the tools used by Flax Typhoon.
- Ensure that critical infrastructure assets are monitored for unusual outbound traffic that could indicate command-and-control communication.
- Verify that access controls and authentication mechanisms for critical systems are robust, as these tools were used to breach such environments.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What hacking tools did the FBI disrupt?
The FBI disrupted MicroScan and FishHub, two tools used by the Chinese state-sponsored group Flax Typhoon.
Who is linked to the hackers behind these attacks?
The hackers are linked to Integrity Technology Group, a China-based company that holds contracts with the Chinese government.
What did the FBI seize to disrupt these operations?
The FBI seized seven domains that were used to operate the MicroScan and FishHub hacking tools.
