U.S. and international partners disrupt Chinese state-sponsored hacking tools

A coordinated international operation led by the United States, including the FBI, DOJ, CISA, and NSA, has disrupted two major hacking tools used by Chinese state-sponsored threat actors. The operation targeted infrastructure belonging to Integrity Technology Group, a Shanghai-listed firm linked to the Flax Typhoon APT.

The seized tools include MicroScan, a Mirai-variant IoT botnet used for large-scale vulnerability scanning, and FishHub, a spear-phishing platform designed to harvest email via Exchange Web Services. These tools have been active since at least 2017 and 2021, respectively, facilitating reconnaissance and data exfiltration against a wide range of targets.

Impacted sectors include government agencies, healthcare, critical infrastructure, and educational institutions across North America, Europe, Asia, and Africa. Specific targets identified include U.S. power companies, airports in Japan and Poland, and at least 20 universities in Taiwan. The disruption involved the seizure of seven domains used by the threat actors to manage their operations.