FBI disrupts Chinese hacking tools used to breach critical infrastructure

Chinese state-sponsored hackers known as Flax Typhoon, operating through the contractor Integrity Technology Group, used two main hacking platforms: MicroScan, a Python-based vulnerability scanner with over 1,300 penetration-testing scripts targeting software such as Oracle WebLogic, Apache Struts, WordPress, and Jenkins; and FishHub, used for spear-phishing and delivering malware to maintain unauthorized remote access and exfiltrate data. The FBI seized seven domains supporting these platforms, which were involved in scanning and breaching critical infrastructure networks in the U.S., Taiwan, Japan, Poland, and other countries. Investigations revealed targeted exploitation of at least eight known vulnerabilities (e.g., CVE-2016-3081, CVE-2019-11510) and use of additional tools like EBurst for password spraying. The FBI coordinated with CISA, NSA, and international partners to issue a cybersecurity advisory with indicators of compromise and mitigation recommendations. This action follows previous disruptions of Integrity Tech's infrastructure and sanctions by the UK and EU.

The hacking tools enabled widespread vulnerability scanning and successful breaches of critical infrastructure and other organizations worldwide, including U.S. government agencies, critical manufacturing, healthcare, IT, law enforcement, educational institutions, and religious organizations. The attackers gained unauthorized remote access, exfiltrated sensitive data, and compromised networks across multiple countries. The disruption of the infrastructure and seizure of domains significantly impairs the operational capabilities of the Flax Typhoon group and its contractor, reducing their ability to conduct further intrusions.

The FBI and international partners have seized the domains supporting the hacking tools, disrupting their operation. Organizations are urged to review the joint cybersecurity advisory containing indicators of compromise, patch known vulnerabilities exploited by these tools, disable unnecessary exposed services, and enforce multifactor authentication. These measures help protect against similar attacks. The disruption of the infrastructure serves as a significant mitigation step by law enforcement.