Integrity Technology Group (Organization): news timeline & CVEs

US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwidenew

FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.

The FBI seized seven domains linked to tools from Chinese firm Integrity Technology Group that Flax Typhoon allegedly used to scan and intrude on networks, including a South Carolina power company. Agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain warned that PRC-linked actors use botnets, malware, vulnerability scanning, cross-site scripting, and password spraying against Microsoft Exchange to steal data. CISA added CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 to the KEV catalog. Court filings say Microscan and FishHub supported intrusions at Taiwanese universities and scans of airports and critical infrastructure.

The Register · Security21:59 UTC · 41m agoThreat actor in the wild 4 sources CVE-2015-3306 CVE-2015-5477 CVE-2016-3081+2 CVEs

DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub

DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to China's Integrity Technology Group.

The U.S. Justice Department and FBI said they seized domains for Microscan, a vulnerability scanner, and FishHub, a spearphishing tool, allegedly run by China-based Integrity Technology Group for Flax Typhoon. A Western District of Pennsylvania court authorized the seizures. FBI, CISA, and NSA warned the actors scan for flaws, use cross-site scripting and password spraying against Microsoft Exchange, persist through VPN software, and steal email and credentials, including from U.S. critical infrastructure. Officials said a Mirai-variant IoT botnet supported Microscan, with targets including a South Carolina power company, airports in Japan and Poland, and universities in Taiwan.

CyberScoopupdated 21:59 UTC · 41m agofirst 20:02 UTC · 2h agoThreat actor in the wild 4 sources

China-linked malicious actors called out by UK and international partners for targeting sensitive data globally

UK and partners attribute global data theft to China-linked Integrity Technology Group and Flax Typhoon-related activity.

The UK NCSC and agencies from Australia, Canada, Japan, New Zealand, Spain, and the United States issued a joint advisory on China-based Integrity Technology Group. The company, which the UK sanctioned last year, is accused of enabling China-linked actors who use AI-assisted scanning, large botnets, and hands-on exploitation to compromise networks and steal sensitive data, including from critical sectors. The activity is described as consistent with campaigns known as Flax Typhoon, Ethereal Panda, and Red Juliett. NCSC urges organizations to apply the mitigations in the FBI-hosted advisory.

NCSC UKupdated 21:59 UTC · 41m agofirst 12:00 UTC · 10h agoThreat actor in the wild 4 sources

Integrity Technology Group

Timeline3 articles

Related CVEsby mentions

Appears with

US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwidenew

DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub

China-linked malicious actors called out by UK and international partners for targeting sensitive data globally