FBI Seizes Seven Domains Linked to Flax Typhoon Hacking Tools
Summary
The FBI seized seven domains used to operate Microscan and FishHub, tools linked to Flax Typhoon and Integrity Technology Group. Authorities say the tools supported global scanning, network intrusions and data theft.
Key points
- The seized domains supported Microscan, used to scan target networks, and FishHub, used in spear-phishing intrusions and to deliver additional malware.
- Authorities link the tools to Flax Typhoon and China-based Integrity Technology Group, which prosecutors say held Chinese government contracts.
- Targets included U.S. critical infrastructure, Taiwanese universities and energy companies, and airports in Japan and Poland.
- The FBI and partner agencies issued a joint advisory recommending timely patching, MFA, disabling unused services and ports, and sanitizing web inputs.
- The DOJ described the domain seizures as its second public disruption of Integrity Technology Group’s infrastructure, following a 2024 botnet takedown.
Article Details
- Event Type
- FBI seizure of seven domains used to operate Microscan and FishHub, hacking tools linked to Flax Typhoon and Integrity Technology Group.
- Impact
- The tools were used to scan and compromise organizations worldwide, including U.S. critical infrastructure, Taiwanese universities and companies, and airports in Japan and Poland. FishHub enabled spear-phishing access and delivery of additional malware. DOJ says about 20 Taiwanese universities are confirmed victims.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 98aiblog[.]com | Seized domain used with SoftEther VPN to maintain remote access to university networks. |
| DOMAIN | 98aicai[.]com | Seized domain used to deliver malware. |
| DOMAIN | 98aicode[.]com | Seized domain used to deliver malware. |
| DOMAIN | c0cc[.]cc | One of the seized domains; Integrity Technology Group used it to access Microscan. |
| DOMAIN | linkedinns[.]net | Seized domain used to deliver malware. |
| DOMAIN | outlook3650[.]com | Seized domain used to deliver malware. |
| DOMAIN | youtubecard[.]com | Seized domain used to deliver malware. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe advisory describes exfiltration of emails and credentials.T1059 · Command and Scripting InterpreterScripts were used to exfiltrate emails and credentials.T1110 · Brute ForceThe advisory says the actors used password spraying.T1566 · PhishingFishHub was used to gain network access through spear phishing.T1595 · Active ScanningMicroscan was used to scan victim networks for weaknesses.
People
Adam JamesFBI special agent who described FishHub in a seizure warrant affidavit.Brett LeathermanAssistant Director of the FBI’s Cyber Division; commented on disrupting companies enabling malicious cyber activity.John A. EisenbergAssistant Attorney General for National Security; commented on disrupting Flax Typhoon’s infrastructure.Troy RivettiU.S. Attorney for the Western District of Pennsylvania; commented on the seizures.
Threat Actors
Malware
Products
FishHubThe FBI seized seven domains used by Microscan and FishHub, two hacking tools tied to Chinese state-sponsored hackers known as Flax Typhoon and linked to Integrity Technology Group.MicroscanThe FBI seized seven domains used by Microscan and FishHub, two hacking tools tied to Chinese state-sponsored hackers known as Flax Typhoon and linked to Integrity Technology Group.Microsoft Exchangevulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails andSoftEther VPNA seventh domain, 98aiblog[.]com, was used by SoftEther VPN software the attackers installed at the two universities scanned with Microscan, to keep remote access to their networks.
Tools
FishHubThe FBI seized seven domains used by Microscan and FishHub, two hacking tools tied to Chinese state-sponsored hackers known as Flax Typhoon and linked to Integrity Technology Group.MicroScanThe FBI seized seven domains used by Microscan and FishHub, two hacking tools tied to Chinese state-sponsored hackers known as Flax Typhoon and linked to Integrity Technology Group.
Countries
ChinaAccording to the US Department of Justice, the hackers worked for Integrity Technology Group (Integrity Tech), a China-based company that holds contracts with the Chinese government.Japancritical infrastructure, Taiwanese universities, and airports in Japan and Poland.Polandcritical infrastructure, Taiwanese universities, and airports in Japan and Poland.TaiwanTwo universities in Taiwan were scanned in August 2022 and March 2023, and the attackers broke into both networks soon after.United StatesPRC and elsewhere of the Department’s dedication to defending and maintaining cybersecurity in the United States and abroad,” said U.S.