[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBiU_fy108kdeytYxm8Efv9N9ymy3-YqmMGii3B9U7nU":3},{"article":4,"iocs":53,"watch_terms":68,"solutions":69,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"64b414d2-0bfe-4fa1-9d25-3adb649a7cea","US Disrupts Chinese State-Sponsored Hacking Tools","us-disrupts-chinese-state-sponsored-hacking-tools-6357f6","Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure. The post US Disrupts Chinese State-Sponsored Hacking Tools appeared first on SecurityWeek.","The US has disrupted two Chinese state-sponsored hacking tools, MicroScan and FishHub, used by Integrity Technology Group for attacks on critical infrastructure. MicroScan, a vulnerability scanner built using a Mirai botnet variant, and FishHub, used for network intrusions via spear phishing, targeted entities in the US, Taiwan, Japan, and Poland. The US seized domains associated with these tools, and both the US and EU have previously sanctioned Integrity Tech.","US disrupts Chinese state-sponsored hacking tools MicroScan and FishHub.","https:\u002F\u002Fwww.securityweek.com\u002Fus-disrupts-chinese-state-sponsored-hacking-tools\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FFlax-Typhoon-disrupted.jpg","2026-10-09T08:36:37+00:00","2026-10-09T10:00:27.693707+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Flax Typhoon","threat_actor",{"name":21,"type":22},"Integrity Technology Group","vendor",{"name":24,"type":25},"MicroScan","product",{"name":27,"type":25},"FishHub",{"name":29,"type":19},"Ethereal Panda","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60,62,64,66],{"type":55,"value":56,"context":57},"domain","c0cc[.]cc","Domain used for MicroScan and FishHub access",{"type":55,"value":59,"context":57},"98aicai[.]com",{"type":55,"value":61,"context":57},"98aicode[.]com",{"type":55,"value":63,"context":57},"outlook3650[.]com",{"type":55,"value":65,"context":57},"youtubecard[.]com",{"type":55,"value":67,"context":57},"linkedinns[.]net",[21,24,27],{"controls":70,"vendors":158},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":130,"name":131,"problem":132,"products":133},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":175},"chinese-state-sponsored-tools-target-critical-infrastructure-via-botnets-and-spear-phishing","Chinese State-Sponsored Tools Target Critical Infrastructure via Botnets and Spear Phishing","Chinese state-sponsored actors leveraged MicroScan, a Mirai-based botnet vulnerability scanner, and FishHub, a spear phishing intrusion tool, to systematically identify and exploit weaknesses in critical infrastructure across multiple nations. The root issue lies in organizations failing to proactively discover and remediate their own vulnerabilities before adversaries do — effectively allowing threat actors to map attack surfaces faster than defenders can close them. Spear phishing success further indicates insufficient security awareness training and weak email filtering controls. This campaign matters because critical infrastructure disruption can cascade into national security, public safety, and economic crises. The US seizure of associated domains demonstrates that passive defense alone is insufficient against persistent, state-funded adversaries.",[164,165,166,167,168,169,170,171,172,173,174],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection (Network Segmentation)","NIST Cybersecurity Framework – ID.RA (Risk Assessment), PR.AC (Access Control), DE.CM (Continuous Monitoring)","NIST SP 800-61 – Computer Security Incident Handling Guide","CISA Cross-Sector Cybersecurity Performance Goals (CPGs) – 2.E Phishing Resistance","EU NIS2 Directive – Article 21 (Security Measures for Critical Infrastructure)",{}]