FBI Seizes Domains Linked to Chinese State-Sponsored Hacking Group Flax Typhoon The FBI has seized seven domains tied to Flax Typhoon, a Chinese state-sponsored hacking group, disrupting two hacking tools MicroScan and FishHub used in cyberattacks against critical infrastructure and organizations worldwide. The domains were operated by Integrity Technology Group (Integrity Tech), a China-based contractor with alleged ties to the Chinese government. The tools were deployed to scan for vulnerabilities and breach networks, including targets in the U.S., Japan, Poland, Taiwan, and other countries. MicroScan, a Python-based vulnerability scanner with over 1,300 penetration-testing scripts, was used alongside a Mirai malware botnet to identify weaknesses in systems running software like Oracle WebLogic, Apache Struts, WordPress, and Jenkins. The FBI confirmed successful breaches at two Taiwanese universities in August 2022 and March 2023, though it did not disclose whether other named targets such as a South Carolina power company, Japanese and Polish airports, and Taiwanese energy firms were compromised. FishHub, the second tool, facilitated spear-phishing attacks and malware delivery, granting attackers remote access to victim networks for data exfiltration. Investigators found stolen files from over 20 organizations, including six Taiwanese universities, on a server linked to the tool. The seized domains c0cc.cc, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, and 98aiblog.com were used to deliver malware and maintain persistence via SoftEther VPN. The operation, conducted in coordination with CISA, NSA, and international partners, also led to a joint cybersecurity advisory detailing the group’s tactics. The advisory revealed that Flax Typhoon targeted U.S. government agencies, critical manufacturing, healthcare, IT, law enforcement, education, and religious organizations, as well as entities in Southeast Asia, Africa, and North America. The attackers exploited eight known vulnerabilities, including CVE-2015-3306 (ProFTPD), CVE-2019-11510 (Pulse Secure VPN), and CVE-2021-22205 (GitLab), and used tools like EBurst for password-spraying attacks on Microsoft Exchange servers. This is not the first disruption of Integrity Tech’s operations. In September 2024, the U.S. dismantled a 200,000-device Mirai botnet linked to the group, while the UK and EU sanctioned the company in 2025 and 2026, respectively, for cyberattacks targeting Western allies. The seized domains now display FBI seizure notices, marking another blow to China’s cyber espionage infrastructure.

Chinese Cybersecurity Firm Linked to Widespread Government and Corporate Email Theft A joint advisory issued on October 8 by the FBI and cybersecurity agencies from six other countries revealed that Integrity Technology Group, a China-based company with alleged ties to the Chinese government, has been orchestrating a large-scale campaign to steal emails from government organizations, law enforcement, healthcare systems, and religious institutions across Southeast Asia, Africa, and North America since at least mid-January 2021. The U.S. and UK sanctioned the company in January 2025 and December 2025, respectively, for its role in cyber intrusions targeting U.S. victims. Former FBI Director Christopher Wray stated in 2024 that the company’s chairman had publicly acknowledged conducting intelligence collection for Chinese government security agencies. ### Attack Methods and Tools The hackers employed a mix of open-source scanning tools (Nmap, masscan, WPScan) and a custom Python-based scanner, MicroScan, containing over 1,300 penetration testing scripts to exploit vulnerabilities in widely used software, including: - OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts - Eight known vulnerabilities (five newly added to CISA’s Known Exploited Vulnerabilities (KEV) catalog), some dating back to 2014 They also used password spraying via EBurst, an open-source tool targeting Microsoft 365 and Exchange accounts, and deployed fake login pages via cross-site scripting (XSS) to trick users into downloading malware disguised as legitimate Windows processes. ### Persistence and Data Theft To maintain access, the hackers installed SoftEther VPN, often renaming it to mimic Windows system files. They extracted credentials using DCSync, a technique that abuses Active Directory replication to steal account data. For email theft, they used: - Curlc4.txt, a PHP-based bot that collects mail via Exchange Web Services (EWS) - office-cli, a tool that repeatedly accesses Microsoft 365 accounts to exfiltrate emails over time - A web application allowing third-party access to stolen emails, though the identities of these parties remain undisclosed In some cases, access to stolen data was restricted to IP addresses in Xiamen, China. ### Botnet Disruption and Ongoing Threats In September 2024, the FBI dismantled a botnet controlled by Integrity Technology Group, comprising over 200,000 hijacked routers, cameras, and consumer devices. The botnet, dubbed Raptor Train, was linked to the same infrastructure used in the email theft campaign. While the advisory does not specify the number of breached organizations, it confirms that the hackers’ activities align with threat groups tracked as Flax Typhoon, Ethereal Panda, and RedJuliett, among others. Integrity Technology Group has denied the allegations, calling the U.S. sanctions baseless. The advisory includes 39 pages of indicators of compromise (IOCs), with some domains and IP addresses dating back to 2016, underscoring the long-term nature of the campaign.