Aric Chen(@aricchen):CCP Cyber Tools Unmasked: Beijing’s Covert War on Critical Systems U.S. authorities have dismantled two sophisticated hacking tools, Microscan and FishHub, developed and operated by Beijing-based Integrity Technology Group. Court documents and joint investigations by the United States, United Kingdom, and European Union identify the firm as the operational backbone of the state-linked Flax Typhoon group. These tools systematically scan networks for vulnerabilities and deploy phishing attacks to implant malware and exfiltrate data. FishHub struck roughly twenty Taiwanese universities, with confirmed breaches at institutions in Hsinchu (2023) and Puli (2022). Microscan probed a South Carolina power company, airports in Japan and Poland, and at least two Taiwanese natural-gas and electricity operators. Once inside, attackers escalate access to steal sensitive files. This is not freelance crime. Flax Typhoon has previously operated botnets infecting over 200,000 devices worldwide, prompting a 2024 FBI takedown and a seven-nation warning (U.S., UK, Australia, Canada, Japan, New Zealand, Spain) that CCP-linked actors are targeting government and private institutions for intelligence theft. The pattern is clear: a Chinese company with regime contracts supplies the infrastructure for persistent, cross-border intrusion into universities, energy grids, and transport hubs. Such operations reveal the CCP’s strategy of using ostensibly commercial entities to conduct deniable espionage against democratic societies. Critical infrastructure and academic research remain high-value targets precisely because compromise yields leverage without open conflict. Aric’s note: The video is a related news segment from the World News I anchor.

2026.10.10 02:26

CCP Cyber Tools Unmasked: Beijing’s Covert War on Critical Systems U.S. authorities have dismantled two sophisticated hacking tools, Microscan and FishHub, developed and operated by Beijing-based Integrity Technology Group. Court documents and joint investigations by the United States, United Kingdom, and European Union identify the firm as the operational backbone of the state-linked Flax Typhoon group. These tools systematically scan networks for vulnerabilities and deploy phishing attacks to implant malware and exfiltrate data. FishHub struck roughly twenty Taiwanese universities, with confirmed breaches at institutions in Hsinchu (2023) and Puli (2022). Microscan probed a South Carolina power company, airports in Japan and Poland, and at least two Taiwanese natural-gas and electricity operators. Once inside, attackers escalate access to steal sensitive files. This is not freelance crime. Flax Typhoon has previously operated botnets infecting over 200,000 devices worldwide, prompting a 2024 FBI takedown and a seven-nation warning (U.S., UK, Australia, Canada, Japan, New Zealand, Spain) that CCP-linked actors are targeting government and private institutions for intelligence theft. The pattern is clear: a Chinese company with regime contracts supplies the infrastructure for persistent, cross-border intrusion into universities, energy grids, and transport hubs. Such operations reveal the CCP’s strategy of using ostensibly commercial entities to conduct deniable espionage against democratic societies. Critical infrastructure and academic research remain high-value targets precisely because compromise yields leverage without open conflict. Aric’s note: The video is a related news segment from the World News I anchor.

Aric Chen@aricchen

2026.10.08 21:47

Some of the email these hackers stole could only be opened from IP addresses in Xiamen, the Chinese port city that faces Taiwan's Kinmen islands. They also ran a web app that let outside users call up one victim's inbox by editing a URL. Both details are in a 58-page advisory the FBI, NSA and agencies from Britain, Canada, Australia, New Zealand, Japan and Spain released on October 8. The FBI also seized two of the group's tools, MicroScan and FishHub, and officials say both are now inoperable. The advisory names the company behind it: Integrity Technology Group, a Beijing firm with links to the Chinese government whose shares trade in Shanghai. Researchers call its work Flax Typhoon. MicroScan alone held more than 1,300 scripts built to probe websites for known holes, in use since at least 2017. Officials say the tools were aimed at a U.S. power company, airports in Japan and Poland, Taiwanese universities and infrastructure firms, and an international nonprofit. Victims of the email theft included government bodies, police, health systems and religious institutions across Southeast Asia. I keep coming back to the Xiamen rule. A for-profit company doesn't wall off stolen inboxes to one city unless it knows exactly who on the other end is meant to read them. This is at least Washington's third move against the same firm in two years. The FBI disrupted its botnet of more than 200,000 devices in September 2024, and Treasury sanctioned it in January 2025. The FBI says it will keep watching for the company to rebuild. ACI — Aric Chen | Insights