FBI disrupts Chinese hacking tools used to breach critical infrastructure

The FBI has taken down seven domains tied to Chinese state-sponsored group Flax Typhoon, cutting off access to two hacking platforms—MicroScan and FishHub—allegedly run by Integrity Technology Group (Integrity Tech), a company with ties to Beijing. MicroScan, a Python-based scanner with over 1,300 pentesting scripts, was used alongside a Mirai-infected device botnet to probe for weaknesses in critical infrastructure, including a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms, and universities, exploiting flaws such as CVE-2015-3306, CVE-2016-3081, CVE-2014-6278 and CVE-2021-22205. FishHub, meanwhile, enabled spear-phishing and follow-on malware deployment, giving attackers remote access and the ability to exfiltrate data—investigators found stolen files from more than 20 organizations on an associated server. The FBI, CISA, NSA and allied agencies jointly released an advisory with indicators of compromise and urged organizations to patch affected systems, limit internet-exposed services, and enable multifactor authentication, marking the latest US action against Integrity Tech following a 2024 botnet takedown and sanctions from the UK and EU.