FBI Seizes Domains Used by Chinese‑Backed Flax Typhoon Tools Microscan and FishHub
What Happened — The FBI, in coordination with U.S. and foreign partners, seized seven domains that were used to host the Microscan and FishHub hacking tools. These tools are linked to the Chinese state‑sponsored group “Flax Typhoon” and were employed to scan and compromise critical infrastructure, airports, NGOs, and universities worldwide between 2022‑2026.
Why It Matters for Trust & Control Assurance
- The incident illustrates how a third‑party contractor (Integrity Technology Group) can extend a nation‑state’s attack surface, directly testing an organization’s vendor‑risk oversight controls.
- Continuous monitoring of external tooling and supply‑chain dependencies provides the evidence needed to demonstrate due diligence and a defensible audit trail.
- Mapping this threat to the control objective of third‑party risk management helps satisfy multiple frameworks (e.g., NIST CSF 2.0) with a single, well‑documented control.
Who Is Affected – Energy & utilities, higher‑education institutions, transportation (airports), and multinational NGOs.
Recommended Actions
- Inventory all external scanning or reconnaissance tools used by vendors and assess their provenance.
- Implement continuous monitoring of domain registrations and DNS activity linked to third‑party services.
- Strengthen contractual clauses requiring vendors to adhere to your organization’s security standards and provide audit evidence.
Source: Help Net Security
Technical Notes – The tools leveraged a Mirai‑variant botnet of compromised IoT devices for automated scanning (Microscan) and spear‑phishing delivery (FishHub). Seized domains included 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, and 98aiblog.com (used for SoftEther VPN persistence).
Source: Help Net Security