US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide

MEDIUM · The Register Security

The FBI and seven allied governments issued a joint advisory warning of ongoing espionage activities by the Chinese state-linked group Flax Typhoon, supported by the private firm Integrity Technology Group. Law enforcement recently seized seven domains associated with Flax Typhoon's infrastructure, including tools used to scan critical infrastructure and exfiltrate data. The group utilizes a Mirai-based botnet, a vulnerability scanner named Microscan, and a post-compromise tool called FishHub to target organizations globally. Technical tactics include cross-site scripting, password spraying on Microsoft Exchange servers, and establishing persistence via VPN software. CISA has added five specific CVEs to its Known Exploited Vulnerabilities Catalog based on this activity, highlighting the exploitation of legacy and recent flaws. Victims include universities in Taiwan, a US power company, and various critical infrastructure entities in the energy and natural gas sectors. While the primary botnet was disrupted in 2024, intelligence indicates that Chinese actors continue to leverage compromised IoT devices and routers for strategic access. The advisory emphasizes the use of these tools to steal sensitive data and credentials from targeted networks.

CVEs: CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894

Threat actors: Flax Typhoon, Integrity Technology Group

Indicators of compromise

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.