[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn0ykLNQkwkDnoo5BSe_najOuCvsvbKAGdDfts_z3dr4":3},{"article":4,"iocs":53,"watch_terms":75,"solutions":76,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"bd543310-3794-4e94-b572-f304c4520046","FBI disrupts Chinese hacking tools used to breach critical infrastructure","fbi-disrupts-chinese-hacking-tools-used-to-breach-critical-infrastructure-00e313","The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]","The FBI has disrupted Chinese state-sponsored hacking operations by seizing seven domains used by the Flax Typhoon group to operate their MicroScan and FishHub tools. These tools were allegedly developed and provided by Integrity Technology Group, a China-based company with government contracts, and were used to scan for vulnerabilities, breach critical infrastructure, and exfiltrate data from organizations worldwide, including in the US, Taiwan, Japan, and Poland.","FBI seizes domains used by Chinese hackers Flax Typhoon to deploy MicroScan and FishHub tools.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-disrupts-chinese-hacking-tools-used-to-breach-critical-infrastructure\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F01\u002F06\u002FChinese-hacker.jpg","2026-10-08T21:42:51+00:00","2026-10-08T22:00:23.430223+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Flax Typhoon","threat_actor",{"name":21,"type":22},"Integrity Technology Group","vendor",{"name":24,"type":25},"MicroScan","product",{"name":27,"type":25},"FishHub",{"name":29,"type":19},"Ethereal Panda","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,63,65,67,69,72],{"type":55,"value":56,"context":57},"domain","c0cc.cc","Domain used by Integrity Tech to access the MicroScan platform.",{"type":55,"value":59,"context":60},"98aicai.com","Domain used to deliver FishHub malware.",{"type":55,"value":62,"context":60},"98aicode.com",{"type":55,"value":64,"context":60},"outlook3650.com",{"type":55,"value":66,"context":60},"youtubecard.com",{"type":55,"value":68,"context":60},"linkedinns.net",{"type":55,"value":70,"context":71},"98aiblog.com","Domain tied to SoftEther VPN software on compromised systems.",{"type":47,"value":73,"context":74},"Mirai","Used in a botnet for scanning targets by MicroScan.",[21,24,27],{"controls":77,"vendors":164},[78,107,136],{"slug":79,"name":80,"problem":81,"products":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":108,"name":109,"problem":110,"products":111},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":52,"name":137,"problem":138,"products":139},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[140,148,156],{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":181},"chinese-state-sponsored-tools-targeted-critical-infrastructure-via-vulnerability-scanning","Chinese State-Sponsored Tools Targeted Critical Infrastructure via Vulnerability Scanning","The Flax Typhoon group, backed by Chinese state interests and supported by a government-contracted company (Integrity Technology Group), used purpose-built tools to systematically scan for and exploit vulnerabilities in critical infrastructure worldwide. This incident highlights how nation-state actors can weaponize commercial-grade tooling to conduct large-scale espionage and data exfiltration campaigns. The breadth of affected nations — including the US, Taiwan, Japan, and Poland — underscores that critical infrastructure sectors remain high-value, persistently targeted environments. Organizations that lack continuous vulnerability scanning and network segmentation are especially exposed to this class of threat, where initial access is gained opportunistically through unpatched or misconfigured systems.",[170,171,172,173,174,175,176,177,178,179,180],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 SA-12 – Supply Chain Protection","NIST Cybersecurity Framework – Identify (ID.SC) Supply Chain Risk Management","NIST Cybersecurity Framework – Protect (PR.AC) Access Control","CISA Critical Infrastructure Security Advisory AA24 (Flax Typhoon)","IEC 62443 – Industrial Automation and Control Systems Security","GDPR Article 32 – Security of Processing (for EU-affected organizations)",{}]