Key points
- The FBI disrupted operations for MicroScan and FishHub, tools linked to the Flax Typhoon group.
- Seven domains were seized as part of an action against Chinese state-sponsored hacking activities.
- The hackers are tied to Integrity Technology Group, a Chinese firm with government contracts.
The Federal Bureau of Investigation has seized seven internet domains that were being used to host hacking tools. These tools, known as MicroScan and FishHub, were utilized by a Chinese state-sponsored group called Flax Typhoon. The group used these resources to launch attacks against critical infrastructure and other organizations in the United States and abroad.
In plain English
Flax Typhoon is a group of hackers supported by the Chinese government. They built two specific software tools to help them find and break into computer systems. MicroScan and FishHub act as scanners and access points for these attacks. By seizing the domains that hosted these tools, the FBI effectively cut off the hackers’ ability to use them for these specific operations. This action disrupts the infrastructure the group relied on to target essential services like energy and transportation networks.
The background
According to Help Net Security, the hackers behind these tools work for Integrity Technology Group, also known as Integrity Tech. This is a company based in China that holds contracts with the Chinese government. The US Department of Justice issued the seizure notice, confirming the link between the company and the cyber operations. SecurityWeek reported that Flax Typhoon and other advanced persistent threats used these tools to scan and compromise systems in the US and other countries. The targets included critical infrastructure sectors, which are vital for national security and economic stability.
What changes now
The immediate result of this action is the removal of the seven domains from the hackers’ control. This disrupts the current operational capability of the MicroScan and FishHub tools. However, threat actors often have backup infrastructure or can develop new tools. Security teams should remain vigilant for similar scanning activity or new tools that might replace the seized ones. The disruption highlights the ongoing nature of state-sponsored cyber threats against essential services.
What to do and how to stay safe: Flax Typhoon
- Monitor network logs for unusual scanning activity or connections to unknown external domains.
- Review firewall rules to ensure they block traffic from known malicious IP addresses and domains.
- Keep all critical infrastructure systems updated with the latest security patches once vendors provide them.
- Conduct regular vulnerability assessments to identify and fix weaknesses before attackers can exploit them.
Step-by-step guide: DDoS Protection: 8 FAQs on Mitigation and Architecture
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is Flax Typhoon?
Flax Typhoon is a Chinese state-sponsored hacking group linked to Integrity Technology Group, a Chinese company with government contracts.
What tools were seized?
The FBI seized domains used to operate MicroScan and FishHub, two hacking tools used to breach critical infrastructure.
Did the FBI stop all Chinese hacking?
No, the FBI seized seven specific domains used by Flax Typhoon, disrupting their current tools but not all hacking activity.
