{
  "id": 12967598,
  "title": "US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide",
  "url": "https://urgent.news/2026/10/08/us-disrupts-chinese-hacking-tools-as-7-govts-warn-of-prc-spies",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-08T21:59:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/08/us-disrupts-chinese-hacking-tools-as-7-govts-warn-of-prc-spies-stealing-sensitive-data-worldwide/5302107"
  },
  "original_language": "en",
  "account": "The FBI recently seized seven internet domains utilized by a Chinese security firm, Integrity Technology Group, in alleged hacking operations. These domains were linked to tools that Chinese-backed cyber operatives used to scan networks for weaknesses in critical infrastructure, including a power company in South Carolina.\n\nThe FBI, alongside agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain, warned that these Chinese-linked attackers employ botnets, malware, and other intrusion techniques to target organizations globally and steal sensitive data, such as from US critical infrastructure networks. They exploit vulnerabilities using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers.\n\nPost this activity, the US Cybersecurity and Infrastructure Security Agency (CISA) added five Common Vulnerabilities and Exposures (CVEs) to its Known Exploited Vulnerabilities Catalog. The court-authorized seizures are part of a series of US law-enforcement efforts to disrupt a Beijing-supported cybercrew known as Flax Typhoon, which allegedly used a Mirai-based botnet to infect devices, scan networks, and launch cyberattacks under the guise of Chinese government hackers.\n\nIntegrity Tech developed the botnet, a tool called Microscan for scanning vulnerabilities, and a post-compromise tool named FishHub, which allegedly stole sensitive data from infected networks. Allegations suggest Integrity Tech had contracts with the PRC government, linking Flax Typhoon to this private firm. Flax Typhoon reportedly conducted successful computer intrusions into universities in Taiwan and a US power company, as well as other organizations worldwide.\n\nThe FBI seized domains like c0cc[.]cc, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net, which facilitated the FishHub malware's distribution and infected over 20 Taiwanese universities. Once the malware infiltrated victims' computers, it used the domains to retrieve additional malicious programs and exfiltrated data to an attacker-controlled server. Despite the dismantling of a 260,000-device botnet in September 2024, ongoing warnings from private sector security researchers and governments suggest Chinese hackers continue targeting critical networks.",
  "summary": "Infecting devices from 2021 until the FBI stepped in",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 4,
    "also_reported_by": [
      {
        "outlet": "Winnipeg Free Press",
        "title": "The FBI has seized tools used by Chinese hackers for cyber operations, officials say",
        "url": "https://urgent.news/2026/10/08/the-fbi-has-seized-tools-used-by-chinese-hackers-for-cyber-operations",
        "published": "2026-10-08T18:14:00.000Z"
      },
      {
        "outlet": "Fortune",
        "title": "FBI says it seized phishing tools used by Chinese hackers in ‘indiscriminate and reckless’ cyber operation",
        "url": "https://urgent.news/2026/10/08/fbi-says-it-seized-phishing-tools-used-by-chinese-hackers-in",
        "published": "2026-10-08T19:48:03.000Z"
      },
      {
        "outlet": "The Register",
        "title": "US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide",
        "url": "https://urgent.news/2026/10/08/us-disrupts-chinese-hacking-tools-as-7-govts-warn-of-prc-spies-12969899",
        "published": "2026-10-08T21:59:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}