Disable MicroScan and FishHub Connections to Stop Flax Typhoon Intrusions

The Federal Bureau of Investigation has executed a disruption operation against two persistent hacking tools, MicroScan and FishHub, which were utilized by the Chinese state-sponsored threat actor known as Flax Typhoon. This action involves the seizure of seven domain names that served as command-and-control infrastructure for these tools. According to BleepingComputer, these domains were essential for the operation of the hacking utilities that breached critical infrastructure and other organizations worldwide. The seizure effectively removes the immediate ability of the attackers to leverage these specific endpoints for scanning and exploitation activities.

Root cause

The underlying issue stems from the infrastructure support provided to the Flax Typhoon group. According to Help Net Security, the hackers behind these operations work for Integrity Technology Group, a China-based company that holds contracts with the Chinese government. The US Department of Justice notes that the People's Republic of China relies on such entities to conduct cyber operations. The root cause of the exposure for victim organizations was not a single software bug in their own systems, but rather the sophisticated scanning and exploitation capabilities of the MicroScan and FishHub tools, which were designed to identify and breach vulnerabilities in target networks.

Attack path

The attack methodology employed by Flax Typhoon involved the use of MicroScan and FishHub to actively scan for vulnerabilities in target systems. According to SecurityWeek, these tools were used to scan and hack US and foreign critical infrastructure. The process likely began with the scanning phase, where the tools identified susceptible entry points across various networks. Once vulnerabilities were detected, the attackers leveraged the tools to gain unauthorized access. The seized domains facilitated the communication between the compromised systems and the attackers, allowing for the exfiltration of data or further lateral movement within the breached networks.

Affected versions

The source material does not specify particular software versions, CVE IDs, or product releases that were directly exploited by MicroScan and FishHub. The attacks targeted critical infrastructure and other organizations globally, implying a broad range of potential victim systems. However, no specific version numbers or software products are identified in the reports from BleepingComputer, SecurityWeek, or Help Net Security as being uniquely vulnerable to these specific tools in this context.

Mitigation

• Monitor network traffic for connections to the seven seized domains associated with MicroScan and FishHub.
• Review logs for suspicious scanning activity indicative of the Flax Typhoon group's tools.
• Ensure all critical infrastructure systems are patched against known vulnerabilities that allow remote exploitation.
• Implement strict access controls and network segmentation to limit lateral movement if a breach occurs.

Background: Threat actors

A threat actor is any individual or group that initiates a security incident. The term distinguishes the person or organization behind the attack from the technical method used. Analysts use this classification to predict future behavior and tailor defenses based on the actor’s goals rather than just their tools.

Read the full guide: Threat Actors Defined: Who They Are and How They Operate

What to do and how to stay safe: Flax Typhoon

• Inspect firewall logs for any historical connections to the domains seized by the FBI to determine if your network was previously targeted.
• Verify that your endpoint detection and response systems are configured to alert on known indicators of compromise associated with Flax Typhoon.
• Conduct a comprehensive vulnerability assessment of your critical infrastructure assets to identify potential entry points for scanning tools.
• Once the vendor provides an update for any affected systems, deploy it immediately to close any exploited gaps.

Step-by-step guide: Unauthorized Access Prevention Checklist for Systems

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is responsible for the MicroScan and FishHub hacking tools?

The tools are linked to the Flax Typhoon group, which works for Integrity Technology Group, a company with contracts with the Chinese government.

What did the FBI seize in this operation?

The FBI seized seven domains that were used to operate the MicroScan and FishHub hacking tools.

Which sectors were targeted by these attacks?

The attacks targeted critical infrastructure and other organizations in the US and abroad.