US Disrupts Chinese State-Linked Hacking Tools Used Against Critical Infrastructure
Summary
The US seized domains used to access MicroScan and FishHub, tools attributed to Integrity Technology Group and linked to Chinese state-sponsored attacks. A joint advisory details their use for reconnaissance, network access, and data theft.
Key points
- The US announced disruption of MicroScan and FishHub, tools attributed to Integrity Technology Group and used by Chinese state-sponsored threat actors.
- MicroScan was used for vulnerability scanning and reconnaissance, including against a US power company and infrastructure in Taiwan.
- FishHub enabled remote access to victim networks, file searches, and data exfiltration; it was used in attacks against at least 20 Taiwanese universities.
- The US seized domains the actors used to access the tools.
- A joint advisory says MicroScan has been active since at least 2017 and contains more than 1,300 scripts for scanning websites for vulnerabilities.
- The advisory describes related activity including credential collection and theft of email data from government, law enforcement, healthcare, and religious organizations in Southeast Asia.
Article Details
- Event Type
- US disruption and seizure of domains used to access hacking tools associated with Chinese state-sponsored cyber activity.
- Impact
- The US announced disruption of MicroScan and FishHub and seized domains used to access them. The tools were used for reconnaissance, network intrusion, and data exfiltration. Reported victims included critical infrastructure, a US power company, NGOs, airports, universities, government organizations, law enforcement agencies, healthcare systems, and religious institutions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 98aicai[.]com | Domain seized by the US that threat actors used to access MicroScan or FishHub. |
| DOMAIN | 98aicode[.]com | Domain seized by the US that threat actors used to access MicroScan or FishHub. |
| DOMAIN | c0cc[.]cc | Domain seized by the US that threat actors used to access MicroScan or FishHub. |
| DOMAIN | linkedinns[.]net | Domain seized by the US that threat actors used to access MicroScan or FishHub. |
| DOMAIN | outlook3650[.]com | Domain seized by the US that threat actors used to access MicroScan or FishHub. |
| DOMAIN | youtubecard[.]com | Domain seized by the US that threat actors used to access MicroScan or FishHub. |
Threat Actors
Malware
Vendors
Tools
BBScanFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordCurlc4.txtThey also used the PHP script Curlc4.txt and command-line utility office-cli for email exfiltration, and DC.ex to extract sensitive data from Active Directory.DC.exThey also used the PHP script Curlc4.txt and command-line utility office-cli for email exfiltration, and DC.ex to extract sensitive data from Active Directory.dirsearchFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordEBurstNmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange password spraying tool for initial access.FishHubBuilt by Integrity Technology Group (Integrity Tech), MicroScan has been used for vulnerability scanning, while FishHub has enabled network intrusions via spear phishing.fscanFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordksubdomainFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordmasscanFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordMicroScanBuilt by Integrity Technology Group (Integrity Tech), MicroScan has been used for vulnerability scanning, while FishHub has enabled network intrusions via spear phishing.NmapFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordoffice-cliThey also used the PHP script Curlc4.txt and command-line utility office-cli for email exfiltration, and DC.ex to extract sensitive data from Active Directory.OneForAllFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordShuiZeFlax Typhoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange passwordSoftEtherThe threat actors deployed VPN tools such as SoftEther for persistence and downloaded databases or manually extracted data from victims’ email addresses.WPScanTyphoon was also seen using BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange password
Countries
ChinaIn some instances, the threat actors restricted access to the exfiltrated data to only IP addresses from Xiamen, China,” the advisory reads.JapanA new joint advisory (PDF) from government agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain shows that MicroScan has been active since at least 2017, targeting Apache Struts, Juniper ScreenOS,PolandTaiwanThe tool has been used in attacks against at least 20 universities in Taiwan.United StatesThe United States on Thursday announced the disruption of two hacking tools used by Chinese state-sponsored threat actors in attacks against US and foreign critical infrastructure.
Industries
Critical infrastructureThe United States on Thursday announced the disruption of two hacking tools used by Chinese state-sponsored threat actors in attacks against US and foreign critical infrastructure.EducationEnergyGovernmentA new joint advisory (PDF) from government agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain shows that MicroScan has been active since at least 2017, targeting Apache Struts, Juniper ScreenOS,HealthcareObserved victims of email data theft included government organizations, law enforcement agencies, healthcare systems, and religious institutions located in Southeast Asia.Law enforcementObserved victims of email data theft included government organizations, law enforcement agencies, healthcare systems, and religious institutions located in Southeast Asia.Religious institutionsObserved victims of email data theft included government organizations, law enforcement agencies, healthcare systems, and religious institutions located in Southeast Asia.