FBI disrupts Chinese hacking tools used to breach critical infrastructure

Live updates

1. 46m ago

   FBI Seizes Hacking Tools Used by Chinese State-Sponsored Group Flax Typhoon

   The FBI and U.S. Department of Justice seized seven domains to disrupt two hacking tools, Microscan and FishHub, operated by the Chinese state-sponsored group Flax Typhoon. These tools were used to scan and breach critical infrastructure and other networks globally. Additionally, the FBI and six other nations identified a separate operation by the sanctioned Integrity Technology Group, which used a tool with over 1,300 scripts to steal emails from government, healthcare, and religious organizations in Southeast Asia since mid-January 2021.

   Why it matters

   These operations highlight a persistent effort by Chinese-linked actors to infiltrate sensitive U.S. and foreign networks. The use of automated scanning and spear-phishing tools allows attackers to identify vulnerabilities across diverse sectors quickly. CISA previously set an October 11 deadline for federal agencies to address five flaws exploited by Flax Typhoon.

   What is confirmed

   • The FBI and Department of Justice seized seven domains used by the Chinese state-sponsored group Flax Typhoon to operate Microscan and FishHub.
   • Microscan and FishHub were used to scan and hack U.S. and foreign critical infrastructure systems.
   • Integrity Technology Group has been sanctioned by the U.S. and the UK.
   • Hackers linked to Integrity Technology Group stole emails from healthcare systems, law enforcement, government organizations, and religious institutions in Southeast Asia.
   • The Integrity Technology Group operation has been active since at least mid-January 2021.

   Still unconfirmed

   • The hacking group ShinyHunters claims to have stolen sensitive personal data on thousands of FBI employees via FBIjobs.gov.
   • ShinyHunters provided a sample of records for approximately 5,000 FBI personnel to 404 Media.

   What to watch next

   • FBI confirmation of the scope of the alleged FBIjobs.gov data theft
   • Further sanctions against entities linked to Flax Typhoon
   Sources used for this update (22)

   1. en.wikipedia.org — Federal Bureau of Investigation - Wikipedia
   2. www.justice.gov — Federal Bureau of Investigation - Department of Justice
   3. en.wikipedia.org — FBI (TV series) - Wikipedia
   4. www.justice.gov — Office of Public Affairs | Justice Department and FBI Seize ...
   5. thehackernews.com — FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
   6. www.bleepingcomputer.com — FBI disrupts Chinese hacking tools used to breach critical infrastructure - BleepingComputer
   7. ticklethewire.com — FBI Investigates Possible Breach After Hackers Claim They Stole Agent Data
   8. BleepingComputer — FBI disrupts Chinese hacking tools used to breach critical infrastructure
   9. AP News — The FBI has seized tools used by Chinese hackers for cyber operations, officials say
   10. The Hacker News — Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
   11. Reuters — US announces effort to disrupt hacking infrastructure run by China's Integrity Tech Group
   12. CyberScoop — DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
   confidence 95%