International Coalition Seizes Chinese State‑Backed Hacking Tools Used in Flax Typhoon Campaign
What Happened — Law‑enforcement agencies from the United States, Europe and Asia coordinated a takedown of two offensive tools—Microscan and FishHub—developed by the Chinese firm Integrity Technology Group (Integrity Tech). The tools have been used since 2017 to scan for vulnerabilities and to deliver malware in phishing attacks against critical‑infrastructure operators, universities, telecoms and media outlets worldwide.
Why It Matters for Trust & Control Assurance
- The episode illustrates the risk of third‑party tooling that can be weaponised against your organization, a scenario continuous control‑assurance programs are built to detect and document.
- Demonstrates the need for ongoing vendor oversight and evidence‑based monitoring of any external code, scripts or services that interact with your environment.
- Provides a concrete example of why a defensible audit trail of third‑party risk assessments is essential for regulators and partners.
Who Is Affected – Energy & utilities, telecommunications, aviation, higher‑education, media, and other critical‑infrastructure sectors that may have been scanned or phished by the seized tools.
Recommended Actions –
- Inventory all external scanning, automation or phishing‑related tools in use and map them to your risk register.
- Validate that each third‑party tool has a documented security review, continuous monitoring, and evidence of remediation.
- Incorporate the findings into your continuous control‑assurance platform to generate real‑time audit evidence.
Technical Notes – Microscan is a vulnerability‑scanning framework that automates web‑app and OT device probing; FishHub is a phishing‑automation platform that delivers malware post‑breach. Both were hosted on seized domains and leveraged botnets for distribution. Source: The Record