MicroScan, FishHub domains seized to block Chinese state actor critical infrastructure campaigns
US authorities disrupted infrastructure targeting campaigns by seizing command domains linked to Chinese state-sponsored actors.
Key points
- The FBI seized seven domains used to operate MicroScan and FishHub.
- The tools were deployed by Flax Typhoon against global critical infrastructure.
- The attackers are linked to Integrity Technology Group, which holds Chinese government contracts.
The US Federal Bureau of Investigation has seized seven domain names that served as command-and-control infrastructure for two hacking tools, MicroScan and FishHub. These tools were utilized by the Chinese state-sponsored threat group known as Flax Typhoon to breach critical infrastructure and other organizations worldwide.
Root cause
The disruption targets the operational backbone of Flax Typhoon’s campaigns rather than a software vulnerability in the victim systems. According to the US Department of Justice, the hackers behind these operations work for Integrity Technology Group, a China-based company that holds contracts with the Chinese government. The seizure removes the specific domains required for the attackers to manage their remote access tools.
Attack path
Flax Typhoon and other advanced persistent threats used MicroScan and FishHub to scan for and exploit vulnerabilities in US and foreign critical infrastructure. The tools allowed the actors to maintain persistent access to compromised networks. By seizing the domains, the FBI has cut off the communication channels necessary for the attackers to control these implants, effectively disrupting ongoing intrusions.
Affected versions
This incident involves the disruption of external attacker infrastructure rather than a patchable software flaw. There are no specific software versions or CVE IDs associated with this action. The impact is on the attackers’ ability to operate their tools rather than on the version history of the targeted systems.
Mitigation
- Monitor network traffic for connections to the seven seized domains.
- Review logs for indicators of compromise associated with MicroScan and FishHub.
- Ensure endpoint detection systems are updated to recognize these specific tool signatures.
What to do and how to stay safe: Flax Typhoon
- Audit outbound network connections to identify any traffic destined for domains associated with Flax Typhoon.
- Review authentication logs for unusual access patterns that may indicate prior compromise by these tools.
- Verify that firewall rules block known command-and-control infrastructure linked to this threat actor.
- Consult with cybersecurity vendors for updated indicators of compromise related to MicroScan and FishHub.
Step-by-step guide: Phishing Defenses: Answers to 10 Critical Questions
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is responsible for the MicroScan and FishHub tools?
The tools are linked to Flax Typhoon, a Chinese state-sponsored group whose operators work for Integrity Technology Group.
What did the FBI seize in this operation?
The FBI seized seven domain names used to operate the MicroScan and FishHub hacking tools.
Who was targeted by these attacks?
The attacks targeted critical infrastructure and other organizations in the US and abroad.
