The Justice Department (DOJ) and FBI announced on Oct. 8 that they seized two hacking tools used by the China state-sponsored hacking group Flax Typhoon to target critical infrastructure and other networks in the United States and abroad.
The court-authorized seizures targeted Microscan and FishHub, two tools allegedly operated by hackers working for Integrity Technology Group (Integrity Tech), a China-based company with contracts with the Chinese government, according to an Oct. 8 press release.
“Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure,” said Brett Leatherman, assistant director of the FBI’s Cyber Division.
According to court documents, Integrity Tech developed Microscan to identify vulnerabilities in computer networks that its clients could later exploit. The tool relied in part on a botnet of internet of things (IoT) devices infected with a variant of Mirai malware.
Microscan targeted a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and power companies, two Taiwanese universities, and a multinational nongovernmental organization.
The second tool, FishHub, allegedly enabled hackers to compromise networks through spear phishing attacks. After gaining initial access, the tool downloaded additional malware that allowed unauthorized remote access or searched for specific files to send to servers controlled by Integrity Tech.
The DOJ said approximately 20 Taiwanese universities were confirmed victims of FishHub activity.
“The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” Leatherman said, referring to the People’s Republic of China. “By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”
The seizures mark the DOJ’s second public disruption of Integrity Tech’s hacking infrastructure. In September 2024, the department disrupted a botnet the company operated that had compromised more than 200,000 consumer devices worldwide, including in the United States.
Alongside the latest seizures, the FBI and its U.S. and international partners released a joint cybersecurity advisory with indicators of compromise tied to Integrity Tech’s activities to help organizations identify and respond to potential intrusions.