Original Coverage & Source Attribution: www.escudodigital.com
The U.S. Department of Justice and the FBI have announced the court-authorized seizure of two cyberattack tools, Microscan and FishHub, operated by Flax Typhoon, a nation-state hacker group sponsored by Beijing.
Both were used to scan for vulnerabilities and conduct spear phishing attacks against critical infrastructure networks, academic institutions, and non-governmental organizations both in the North American country and in other territories.
Judicial investigations point to Integrity Technology Group (Integrity Tech), a China-based company contracted by the Chinese Government to execute advanced cyber operations, as responsible.
Detected targets include energy facilities in the U.S. and Taiwan, airports in Japan and Poland, universities, and global NGOs.
This is the second major operation to dismantle the technological framework of this company in two years, following the neutralization in September 2024 of a botnet network of more than 200,000 infected devices.
Flax Typhoon (a designation assigned by the cybersecurity community to this advanced persistent threat (APT)) typically uses a bot network, whose IoT (Internet of Things) devices are infected with variants of the Mirai malware to conduct massive vulnerability reconnaissance and facilitate unauthorized remote intrusions.
“We will not allow China or its intermediaries to act against U.S. interests with impunity in cyberspace. The National Security Division will continue to respond firmly and use all tools at our disposal to disrupt Flax Typhoon threats and dismantle the infrastructure that supports them,” said John A. Eisenberg, Deputy Attorney General for National Security.
Meanwhile, the Deputy Director of the FBI’s Cyber Division, Brett Leatherman, highlighted the role of the Chinese Government’s subcontracting model. “The People’s Republic of China relies on contracting and facilitating companies to expand the reach and scale of its malicious cyber activities. By exposing and dismantling these facilitators, we make it more difficult for them to target U.S. networks and infrastructure,” he pointed out.
Additionally, the U.S. Attorney for the Western District of Pennsylvania, Troy Rivetti, emphasized that the operation sends “a clear message to the cybercriminals of the People’s Republic of China (PRC) about the Department’s dedication to defending cybersecurity both at home and abroad.”
The geographic code
The ‘Typhoon’ surname is also shared by other cybercriminals. Microsoft and other cybersecurity experts give this nickname to Chinese state threat actors. These names are used to clearly show their nationality. Similarly, Russian adversaries are usually named with the particle Bear or Blizzard, North Koreans as Sleet, and Iranians as Sandstorm.
The U.S. Department of Justice and the FBI have announced the court-authorized seizure of two cyberattack tools, Microscan and FishHub, operated by Flax Typhoon, a nation-state hacker group sponsored by Beijing.
Both were used to scan for vulnerabilities and conduct spear phishing attacks against critical infrastructure networks, academic institutions, and non-governmental organizations both in the North American country and in other territories.
Judicial investigations point to Integrity Technology Group (Integrity Tech), a China-based company contracted by the Chinese Government to execute advanced cyber operations, as responsible.
Detected targets include energy facilities in the U.S. and Taiwan, airports in Japan and Poland, universities, and global NGOs.
This is the second major operation to dismantle the technological framework of this company in two years, following the neutralization in September 2024 of a botnet network of more than 200,000 infected devices.
Flax Typhoon (a designation assigned by the cybersecurity community to this advanced persistent threat (APT)) typically uses a bot network, whose IoT (Internet of Things) devices are infected with variants of the Mirai malware to conduct massive vulnerability reconnaissance and facilitate unauthorized remote intrusions.
“We will not allow China or its intermediaries to act against U.S. interests with impunity in cyberspace. The National Security Division will continue to respond firmly and use all tools at our disposal to disrupt Flax Typhoon threats and dismantle the infrastructure that supports them,” said John A. Eisenberg, Deputy Attorney General for National Security.
Meanwhile, the Deputy Director of the FBI’s Cyber Division, Brett Leatherman, highlighted the role of the Chinese Government’s subcontracting model. “The People’s Republic of China relies on contracting and facilitating companies to expand the reach and scale of its malicious cyber activities. By exposing and dismantling these facilitators, we make it more difficult for them to target U.S. networks and infrastructure,” he pointed out.
Additionally, the U.S. Attorney for the Western District of Pennsylvania, Troy Rivetti, emphasized that the operation sends “a clear message to the cybercriminals of the People’s Republic of China (PRC) about the Department’s dedication to defending cybersecurity both at home and abroad.”
The geographic code
The ‘Typhoon’ surname is also shared by other cybercriminals. Microsoft and other cybersecurity experts give this nickname to Chinese state threat actors. These names are used to clearly show their nationality. Similarly, Russian adversaries are usually named with the particle Bear or Blizzard, North Koreans as Sleet, and Iranians as Sandstorm.
Become a premium member for free!
