US Disrupts Chinese State-Sponsored Hacking Tools

What it is

Flax Typhoon's full tooling chain beyond MicroScan/FishHub, as detailed in a joint advisory from US, UK, Australia, Canada, Japan, New Zealand, and Spain. The actors behind these tools are Integrity Technology Group, previously disrupted via the Raptor Train botnet takedown in 2024 and sanctioned by the US in 2025 and the EU in March 2026.

How it works

The advisory maps the actor's kill chain tool-by-tool:

• Reconnaissance: BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, WPScan (alongside MicroScan).
• Initial access: command-line exploit utilities plus EBurst for Exchange password spraying.
• Persistence: SoftEther VPN.
• Data collection/exfiltration: Curlc4.txt (a PHP script) and office-cli (command-line utility) for email exfiltration; DC.ex for Active Directory data extraction; databases downloaded or manually extracted from victim mailboxes.

The advisory notes exfiltrated data access was in some cases IP-restricted to Xiamen, China, which is cited as attribution evidence.

Preconditions / Affected

Email data theft victims (via the on-prem/cloud credential and exfiltration toolchain) included government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia — a separate victim set from the MicroScan/FishHub critical-infrastructure and university targets already noted in the summary. MicroScan has been active since at least 2017 and also targets Juniper ScreenOS, Oracle, and Rejetto HFS (in addition to the services already listed).

What to do

The seized domains used to access MicroScan/FishHub are listed in the advisory as indicators: c0cc[.]cc, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net. Defenders handling Exchange or AD environments should treat EBurst (password spraying) and DC.ex (AD data extraction) as named tools to hunt for, and SoftEther VPN presence as a persistence indicator.

Caveats

The advisory does not give version numbers, hashes, or detection signatures for these secondary tools (EBurst, DC.ex, SoftEther, Curlc4.txt, office-cli) — only their names and functions. Attribution to Xiamen is based on observed IP restrictions, not independently verified by the article.