US Disrupts Chinese State-Sponsored Hacking Tools

MicroScan is a Python-based web application with over 1,300 penetration testing scripts designed to scan websites for specific vulnerabilities in software such as Apache Struts, Juniper ScreenOS, Jenkins, OpenSSL, Oracle, Rejetto HFS, WebLogic Server, and WordPress. FishHub enabled remote network access, file searching, and data exfiltration via spear phishing. Both tools were used by the Chinese state-sponsored group Flax Typhoon and possibly other APTs. Integrity Technology Group used a Mirai variant to build an IoT botnet to support MicroScan reconnaissance. Victims included US power companies, NGOs, airports in Japan and Poland, Taiwanese universities, and critical infrastructure. The US seized multiple domains used for command and control and previously disrupted related botnets and sanctioned the developer. The threat actors collected credentials and exfiltrated email data from on-premises and cloud systems, restricting access to IPs from Xiamen, China. This activity targeted government, law enforcement, healthcare, and religious organizations in Southeast Asia.

The disruption of MicroScan and FishHub tools impedes Chinese state-sponsored APTs' ability to conduct vulnerability scanning, network intrusions, credential theft, and data exfiltration against critical infrastructure and sensitive organizations. The tools facilitated reconnaissance and exploitation of multiple software vulnerabilities and enabled persistent access and data theft from victims across several countries. The impact includes compromised confidentiality and integrity of targeted organizations' systems and data, particularly in critical infrastructure sectors and academia. The US and allied actions have disrupted these capabilities, reducing the threat actors' operational effectiveness.

The US and allied governments have seized domains used by the threat actors and disrupted their botnets, effectively mitigating the immediate threat posed by MicroScan and FishHub. Organizations should review the joint advisory from the US, UK, Australia, Canada, Japan, New Zealand, and Spain for detailed indicators and guidance. No additional urgent remediation steps are indicated beyond following official advisories and maintaining vigilance against spear phishing and exploitation of known vulnerabilities targeted by these tools.