DOJ and FBI Seize Flax Typhoon-Linked Tools Microscan and FishHub
Summary
The DOJ and FBI seized domains used to access Microscan and FishHub, tools linked to China-based Integrity Technology Group and Flax Typhoon. A joint agency advisory describes targeting of organizations worldwide, including critical infrastructure.
Key points
- The DOJ and FBI obtained court-authorized seizures of domains associated with Microscan and FishHub.
- Microscan is described as a vulnerability-scanning tool; FishHub is a spearphishing tool that can download malware after gaining network access.
- U.S. agencies link the tools to Integrity Technology Group, a China-based company previously sanctioned and targeted in a botnet takedown.
- The FBI, CISA and NSA advisory says actors use automated scanning, botnets, vulnerability exploitation, cross-site scripting and password spraying against Microsoft Exchange servers.
- The advisory also describes persistence through VPN software and theft of emails and credentials using scripts.
- Reported Microscan targets include a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and Taiwanese universities; FishHub victims include Taiwanese universities.
- CISA warned that China-linked actors are positioning themselves in critical infrastructure, including operational technology networks.
Article Details
- Event Type
- DOJ and FBI seized domains associated with Microscan and FishHub, tools linked to Flax Typhoon and Integrity Technology Group.
- Impact
- The seizures were intended to deny hackers access to the vulnerability-scanning tool Microscan and the spearphishing tool FishHub. The article says Microscan targets included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies, and universities in Taiwan; FishHub victims included Taiwanese universities.
People
Threat Actors
Products
FishHubmeant to deny hackers access to the vulnerability scanning tool Microscan and the spearphishing tool FishHub created by the Chinese firm Integrity Technology Group, which the United States sanctioned last year.MicroscanThe domain name seizures were meant to deny hackers access to the vulnerability scanning tool Microscan and the spearphishing tool FishHub created by the Chinese firm Integrity Technology Group, which the United StatesMicrosoft Exchangevulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and
Countries
ChinaThe Justice Department and FBI announced that they had seized two hacking tools connected to the Chinese government-linked group Flax Typhoon and a China-based company that the U.S.JapanMicroscan targets have included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and universities in Taiwan and others, according to the FBI and DOJ.PolandMicroscan targets have included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and universities in Taiwan and others, according to the FBI and DOJ.TaiwanMicroscan targets have included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and universities in Taiwan and others, according to the FBI and DOJ.United Statesand the spearphishing tool FishHub created by the Chinese firm Integrity Technology Group, which the United States sanctioned last year.