Raptor Train (Malware): news timeline & CVEs

US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwidenew

FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.

The FBI seized seven domains linked to tools from Chinese firm Integrity Technology Group that Flax Typhoon allegedly used to scan and intrude on networks, including a South Carolina power company. Agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain warned that PRC-linked actors use botnets, malware, vulnerability scanning, cross-site scripting, and password spraying against Microsoft Exchange to steal data. CISA added CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 to the KEV catalog. Court filings say Microscan and FishHub supported intrusions at Taiwanese universities and scans of airports and critical infrastructure.

The Register · Security21:59 UTC · 47m agoThreat actor in the wild 4 sources CVE-2015-3306 CVE-2015-5477 CVE-2016-3081+2 CVEs

FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.

On October 8, the FBI and agencies in six other countries said hackers tied to China's Integrity Technology Group stole email from government, law enforcement, healthcare, and religious organizations since at least mid-January 2021. The actors scanned sites with tools including MicroScan, which holds more than 1,300 scripts, guessed Microsoft 365 and Exchange passwords, copied mailboxes, and run a web app that gives unnamed third parties access to stolen email. The joint advisory lists eight exploited flaws—CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894—and says five were newly added to CISA's KEV catalog. The activity is consistent with Flax Typhoon, Ethereal Panda, and RedJuliett; the U.S. and UK have sanctioned the company, previously linked to the Raptor Train botnet of more than 200,000 devices.

The Hacker News18:32 UTC · 4h agoThreat actor in the wildCVE-2014-6278 CVE-2015-3306 CVE-2015-5477+5 CVEs

Raptor Train

Timeline2 articles

Related CVEsby mentions

Appears with

US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwidenew

FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails