FBI seizes Chinese hacking tools used against critical infrastructure

· Cybersecurity · United States · China

The FBI, working with an international coalition, seized seven domains used by the Chinese state-sponsored hacking group Flax Typhoon to operate two tools, MicroScan and FishHub, which were used in intrusions against critical infrastructure and other organizations worldwide. The infrastructure belonged to Beijing-based Integrity Technology Group, which authorities in the U.S. and six other countries said ran a portal granting third parties access to email stolen from government agencies, law enforcement, healthcare systems and religious institutions, mainly in Southeast Asia. Integrity Technology Group has already been sanctioned by the U.S. The takedown removes the scanning and intrusion tooling the group relied on, though the campaign's operators remain active.

Why it matters：State-linked intrusion tooling being seized mid-campaign shows how governments are turning offensive cyber capabilities into an enforcement target, a shift that affects any organization running exposed internet-facing infrastructure.

Key points

  • Seven domains tied to Flax Typhoon's MicroScan and FishHub tools were seized.
  • The U.S. and agencies in six other countries attributed the activity to Integrity Technology Group.
  • Stolen email came from government, law enforcement, healthcare and religious organizations in Southeast Asia.

Sources (original reporting)

More stories from this day