Flax Typhoon Advisory AA26-281A Names Integrity Tech and Eight Old CVEs

CISA, the FBI and the NSA named Integrity Technology Group on October 8 as a China-based company that enables Flax Typhoon intrusions, in joint advisory AA26-281A, and the Justice Department said it seized domains tied to two of the company's tools the same day. Both documents describe the activity as alleged, and neither announces charges against any person.

The defender's takeaway is in Appendix B of the advisory: eight CVEs the actors exploited successfully, the oldest from 2014 and five of them newly added to CISA's Known Exploited Vulnerabilities catalogue.

What the advisory says Integrity Tech did

The advisory, titled "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data", says the actors enabled by Integrity Tech use techniques "consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett". Victims include government services, critical manufacturing, healthcare, information technology, US law enforcement, education and religious organisations in North America, Southeast Asia and Africa.

Chris Butera, CISA's Acting Executive Assistant Director for Cybersecurity, said Chinese government-affiliated actors "continue to position themselves within critical infrastructure networks". The advisory names no botnet and gives no victim count.

The two tools the DOJ targeted

The Justice Department release, unsealed in the Western District of Pennsylvania, describes MicroScan as a reconnaissance and vulnerability scanner, often run through a botnet of IoT devices infected with a Mirai variant. The advisory says MicroScan is a Python tool with more than 1,300 penetration-testing scripts and has been used since 2017.

The other tool, FishHub, handled spear phishing and then downloaded malware that gave clients remote access or hunted for files to send to Integrity Tech servers. The department confirmed about 20 Taiwanese universities as FishHub victims. MicroScan's listed targets include a power company in South Carolina, a multinational NGO, airports in Japan and Poland, Taiwanese gas and power companies and two Taiwanese universities. The release separates those scanning targets from confirmed compromises.

On the seizures, the sources disagree on a count. The Justice Department lists six domains, c0cc[.]cc for MicroScan access and five for FishHub delivery. The Hacker News headline says seven and lists 98aiblog[.]com in addition. The department's six are the figure used here.

The eight CVEs in Appendix B

CVE	Product	Flaw type
CVE-2014-6278	GNU Bash through 4.3	Remote code execution
CVE-2015-3306	ProFTPD 1.3.5	Unauthorized read
CVE-2015-5477	ISC BIND 9.x	Denial of service
CVE-2016-3081	Apache Struts 2.3.x	Remote code execution
CVE-2019-11510	Pulse Connect Secure	Unauthorized read
CVE-2021-22205	GitLab 11.9 onward	Remote code execution
CVE-2021-3199	ONLYOFFICE DocumentServer 5.1.5 to 5.6.2	Unauthorized write
CVE-2023-22894	Strapi up to 4.5.5	Information disclosure

The advisory marks CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199 and CVE-2023-22894 as new to the catalogue. Those five are the ones our earlier report covered as a three-day federal deadline under BOD 26-04, which set agencies a due date of October 11. That story did not name the actor. This advisory does. Apple's CoreGraphics zero-day fell under the same directive with a separate 14-day date.

Post-exploitation tooling to hunt for

The advisory lists SoftEther VPN clients disguised as conhost.exe or dllhost.exe for persistence, DCSync run through DC.exe against domain controllers, and a payload live700_v1.exe that masquerades as DiagTrack.exe. For mail, Curlc4.txt is a PHP script that pulls messages through Exchange Web Services, and the EBurst tool password-sprays across 10 Exchange interfaces including OWA, EWS, Autodiscover and ActiveSync. Appendix A carries six webshells, 16 binaries and scripts, and STIX files in JSON and XML.

The advisory warns that many listed indicators date to 2016 or later and should be vetted before blocking. Its mitigations include multifactor authentication on webmail and VPNs, disabling unused services, and replacing end-of-life products. FBI Assistant Director Brett Leatherman said the PRC "relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity." Attribution to Integrity Tech and to Chinese government ties remains the allegation of the agencies, and neither document carries a statement from Integrity Tech.