FBI Seizes Seven Domains Tied to Chinese Hacking Tools

The FBI seized seven domains linked to two hacking platforms used by Flax Typhoon, a China-linked group, in attacks on critical infrastructure and other organizations worldwide. U.S. authorities say the platforms were operated by China-based Integrity Technology Group, which they say has contracts with the Chinese government.

MicroScan scans networks for vulnerabilities. An FBI affidavit says operators used it with a botnet of internet-connected devices infected with Mirai malware to scan potential targets, including a South Carolina power company, airports in Japan and Poland, Taiwanese energy companies, and universities. The affidavit says scans of two Taiwanese universities in August 2022 and March 2023 were followed by successful breaches. The FBI has not said whether the specifically named power companies, airports, or energy providers were breached.

FishHub was used for spear-phishing and to deliver malware that gave attackers remote access to compromised networks and let them search for and steal files. Investigators found data belonging to more than 20 organizations on a server linked to the tool, including six Taiwanese universities, according to the affidavit.

The FBI seized domains used to access MicroScan and deliver FishHub malware, plus a seventh domain tied to SoftEther VPN software found on compromised systems. The FBI, CISA, NSA, and international partners also issued a joint advisory describing the activity and listing indicators of compromise. The advisory says the operations overlap with activity tracked as Flax Typhoon, Ethereal Panda, and Red Juliett, while cautioning that not all of it may be linked to Integrity Tech.