The FBI has seized seven domains supporting hacking tools allegedly used by Chinese state-sponsored attackers to compromise organizations worldwide. The Flax Typhoon disruption targeted infrastructure behind MicroScan and FishHub, two platforms linked to vulnerability scanning, network intrusions and data theft.
U.S. authorities attribute the platforms to China-based Integrity Technology Group, which they say holds Chinese government contracts. Investigators linked the tools to operations affecting critical infrastructure and other organizations in the United States and abroad.
MicroScan Helped Attackers Identify Vulnerable Networks
According to investigators, Integrity Tech developed MicroScan to locate security weaknesses in websites and network services.
The Python-based platform contains more than 1,300 penetration-testing scripts. These target applications including Oracle WebLogic, Apache Struts, WordPress and Jenkins.
The FBI says attackers combined MicroScan with a network of internet-connected devices infected with Mirai malware to scan potential victims.
Targets included a South Carolina power company, airports in Japan and Poland, Taiwanese energy providers and universities.
However, scanning does not automatically establish a successful intrusion. Investigators confirmed that two Taiwanese universities suffered breaches after MicroScan activity in August 2022 and March 2023.
Although authorities also confirmed intrusions involving critical infrastructure, they did not disclose whether the specifically named airports or energy companies suffered successful breaches.
FishHub Supported Phishing and Data Theft
The second platform, FishHub, supported targeted phishing attacks and malware delivery inside already compromised networks.
According to the FBI, its malware provided unauthorized remote access, searched for selected files and transferred stolen information to Integrity Tech-controlled servers.
Investigators found files and data belonging to more than 20 organizations on a server associated with FishHub. Those organizations included six Taiwanese universities.
The domain seizures covered one MicroScan access domain and five domains used to deliver malware.
Meanwhile, a seventh domain supported SoftEther VPN software installed on compromised systems to maintain remote access. The seized domains now display FBI notices.
Joint Advisory Describes a Wider Set of Targets
Alongside the Flax Typhoon disruption, the FBI, CISA, NSA and international partners published a joint cybersecurity advisory.
The agencies described activity targeting government bodies, critical manufacturing, healthcare, technology companies, law enforcement, educational institutions and religious organizations.
Their findings also covered victims across Southeast Asia, Africa and North America.
The activity overlaps with operations tracked as Flax Typhoon, Ethereal Panda and Red Juliett. However, the agencies cautioned that not every observed incident necessarily connects to Integrity Tech.
Older Vulnerabilities Remained Part of the Attack Toolkit
Investigators identified eight vulnerabilities that the attackers commonly targeted:
- CVE-2015-3306: Unauthorized file access in ProFTPD.
- CVE-2015-5477: A denial-of-service flaw in ISC BIND.
- CVE-2016-3081: Remote code execution in Apache Struts.
- CVE-2021-3199: Unauthorized file writing in ONLYOFFICE DocumentServer.
- CVE-2023-22894: Information disclosure in Strapi.
- CVE-2014-6278: A GNU Bash remote code execution flaw associated with Shellshock.
- CVE-2019-11510: Arbitrary file reading in Pulse Secure VPN.
- CVE-2021-22205: Remote code execution in GitLab.
The attackers also used the open-source EBurst tool for password spraying against Microsoft Exchange servers.
Additional tools helped them steal emails, collect Active Directory credentials and transfer data from compromised environments.
Furthermore, the FBI discovered a custom web application that allowed third parties to browse stolen emails without accessing the original accounts.
Authorities Publish Indicators to Help Identify Intrusions
The joint advisory includes domains, IP addresses, malware hashes and technical details about the attackers’ tools.
Authorities recommend reviewing these indicators, patching vulnerable systems, disabling unnecessary internet-facing services and enforcing multifactor authentication.
The seizures follow an earlier operation against infrastructure attributed to Integrity Tech. In September 2024, U.S. authorities disrupted a Mirai botnet involving more than 200,000 compromised consumer devices.
Separately, the United Kingdom sanctioned Integrity Tech in 2025. The European Union followed in 2026 over its involvement in cyberattacks targeting Europe and allied countries.
0 responses to “FBI Seizes Domains Linked to Flax Typhoon Hacking Tools”