[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

2 clusters · 39 sources · 3 days · First seen · Last updated

US-led disruption of Flax Typhoon hacking infrastructure

Overview

Law enforcement agencies, led by the FBI, DOJ, CISA, and NSA, have conducted operations to disrupt cybercriminal networks and state-sponsored hacking infrastructure.

Initial reports detailed the arrest of a Canadian citizen in Pennsylvania linked to the ShinyHunters group, which allegedly breached an FBI jobs portal through a third-party vendor.

In a coordinated international effort, authorities also targeted the Flax Typhoon threat group, which is linked to the Shanghai-listed Integrity Technology Group. The operation resulted in the seizure of seven domains and the neutralization of two key tools: MicroScan, a Mirai-variant IoT botnet used for vulnerability scanning, and FishHub, a spear-phishing platform.

These tools had been active since at least 2017 and 2021, targeting critical infrastructure, government agencies, healthcare, and educational institutions across North America, Europe, Asia, and Africa. Specific victims included U.S. power companies, airports in Japan and Poland, and at least 20 universities in Taiwan.

Entities

FBI · CISA · Flax Typhoon · Integrity Technology Group · NSA

Timeline

  1. [TECHNOLOGY] 7 sources
    U.S. and international partners disrupt Chinese state-sponsored hacking tools

    U.S. and international agencies have disrupted Chinese state-sponsored hacking tools MicroScan and FishHub, used by Flax Typhoon to target global critical infrastructure and universities.

  2. [TECHNOLOGY] 33 sources
    FBI arrests suspect in ShinyHunters hack and disrupts China-linked Flax Typhoon

    The FBI has arrested a Canadian suspect in the ShinyHunters hack of its jobs portal and disrupted the China-linked Flax Typhoon hacking group by seizing key tools and domains.

Sources

australiancybersecuritymagazine.com.au · bhaskarlive.in · calgary.citynews.ca · cybernoz.com · diebewertung.de · edmonton.citynews.ca · epochtimes.com · flagthis.com · foxnews.com · gamesource.it · hackread.com · home.dgabc.com.br · hongkongfp.com · hosyusokuhou.jp · independent.co.uk · it-boltwise.de · joemygod.com · kaaltv.com · kesq.com · keyt.com · kion546.com · krebsonsecurity.com · krmg.com · news18.com · ntd.com · offthepress.com · perthnow.com.au · saferworld.org.uk · sgtreport.com · singtaousa.com · somoscordobeses.com · techcoffeehouse.com · thehackernews.com · theyeshivaworld.com · topky.sk · triblive.com · vosveteit.zoznam.sk · whec.com · winnipeg.citynews.ca