The FBI Has Seized Tools Used by Chinese Hackers for Cyber Operations, Officials Say

The FBI has seized scanning and phishing tools utilized by a hacker group believed to be linked to the Chinese government, officials revealed on Thursday. These tools, dubbed "Microscan" and "FishHub," were employed to scan, phish, and infiltrate targets encompassing U.S. and foreign critical infrastructure, academia, and power sectors, officials disclosed.

Microscan was utilized to specifically target a U.S. power company, Japanese and Polish airports, Taiwanese universities, a multinational NGO, and Taiwanese critical infrastructure firms. Meanwhile, FishHub facilitated phishing endeavors, granting hackers remote access to compromised networks, according to the FBI.

The recent operation has rendered these tools ineffective, deemed a setback for the hacking campaign according to FBI and Justice Department officials. Assistant Director Jason Bilnoski emphasized their objective to strip threat actors of their capabilities, targeting their infrastructure, finances, and tools. He labeled the hacking operation as "indiscriminate and reckless."

The tools were operated by a Chinese-based information security firm, Integrity Technology Group, which the FBI identifies as the true identity behind Flax Typhoon. The company holds contracts with the Chinese government, as per the FBI.

Earlier in September 2024, the FBI reported disrupting a vast botnet associated with Flax Typhoon, which had infected over 200,000 consumer devices including cameras, video recorders, and routers, to enable cybercrimes such as stealing sensitive data. FBI San Diego Supervisory Special Agent Brett Lally stated that the department would remain vigilant for any potential reestablishment of the company's infrastructure in China.