CriticalBreach
FBI disrupts Chinese hacking tools used to breach critical infrastructure
BleepingComputer·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
Key details
- FBI seized seven domains used by Chinese state-sponsored group Flax Typhoon to operate MicroScan and FishHub hacking tools.
- Integrity Technology Group developed the tools and has contracts with the Chinese government, per U.S. authorities.
- Scanning activity led to confirmed breaches at two Taiwanese universities in August 2022 and March 2023.
Affected
- U.S. government agencies, critical manufacturing, healthcare, IT, law enforcement, education, religious organizations, and entities in Southeast Asia, Africa, North America.
- Specific targets included a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and electricity companies, and universities.
Fixes and mitigations
- Patch vulnerable systems, disable unnecessary exposed services, and enforce multifactor authentication.
What to look for
- IP addresses, domains, malware hashes, and tool details listed in the joint advisory.
- Use of EBurst tool for password-spraying against Microsoft Exchange servers.
- SoftEther VPN software installed on compromised systems for persistent remote access.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.