FBI Seizes Seven Domains, Disrupts Flax Typhoon's MicroScan and FishHub Hacking Tools

FBI and DOJ Dismantle Flax Typhoon's Hacking Infrastructure

The FBI and the U.S. Department of Justice announced on October 8, 2026 that they had executed a court-authorized seizure of seven domains used by the China-linked state-sponsored group Flax Typhoon to operate two offensive tools, MicroScan and FishHub. The domains supported infrastructure built and run by Integrity Technology Group ("Integrity Tech"), a Beijing-based company that U.S. officials say holds contracts with the Chinese government and has been directly tied to Flax Typhoon's intrusion activity. Investigators say the two platforms were used to scan, and in some cases breach, critical infrastructure and other organizations across multiple continents, including a South Carolina power utility, airports in Japan and Poland, and natural gas and electricity companies in Taiwan.

The action was coordinated with a joint cybersecurity advisory, AA26-281A, co-authored by the FBI, CISA, the NSA, and partner agencies from the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain. It details how China-linked actors — whose tactics overlap with the clusters publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett — combined automated scanning with hands-on-keyboard intrusions to steal sensitive data, including large volumes of email.

Incident Details

How the Operation Worked

MicroScan — reconnaissance at scale

MicroScan is a Python-based vulnerability-scanning platform containing more than 1,300 penetration-testing scripts, according to the FBI's seizure affidavit. Integrity Tech paired it with a botnet of internet-of-things devices — routers, IP cameras, video recorders, and network-storage devices — infected with a Mirai malware variant, routing scan traffic through those compromised consumer devices so it appeared to originate from geographically distributed, legitimate-looking IP addresses. MicroScan's target list of known flaws spanned products including OpenSSL, Oracle WebLogic, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts, and the operators supplemented it with open-source utilities such as Nmap, Fscan, and WPScan.

FishHub — phishing and data exfiltration

FishHub handled the follow-on intrusion and theft stage. The seven seized domains included several crafted to impersonate trusted brands — outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net mimicked Outlook, YouTube, and LinkedIn respectively — to lure targets into spear-phishing lures. Once deployed inside a victim network, FishHub gave operators unauthorized remote access, the ability to search for specific files, and a channel to exfiltrate data back to Integrity Tech-controlled servers. The FBI said a server linked to FishHub contained data and files belonging to more than 20 organizations, including six Taiwanese universities, two of which investigators determined had actually been breached in 2022–2023.

EBurst and the Exchange mailbox-theft campaign

The joint advisory separately details how the same actor set combined EBurst, an open-source Python tool, with password spraying and password guessing against Microsoft Exchange (via ECP, EWS, OAB, and OWA interfaces) and Microsoft 365 cloud accounts to harvest credentials and bulk-steal mailboxes. Once inside, the actors established persistence using SoftEther VPN clients disguised as legitimate Windows processes (conhost.exe, dllhost.exe), and deployed Mimikatz to dump credentials from LSASS memory for lateral movement. Victims of the mailbox-theft campaign reportedly included government offices, law enforcement agencies, healthcare systems, and religious institutions, primarily in Southeast Asia.

Impact Assessment

Recommendations

For critical infrastructure operators

• Treat any historical exposure to the scanning behavior described in AA26-281A (automated vulnerability probing followed by targeted follow-up) as a potential indicator of prior reconnaissance, and review logs covering the affected period.
• Patch internet-facing instances of the products named in MicroScan's target list — OpenSSL, Oracle WebLogic, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts — and prioritize any instance still running versions affected by known CVEs, including CVE-2021-22205 (GitLab) and CVE-2019-11510 (Pulse Connect Secure), both referenced in the advisory's exploitation history.
• Segment operational technology (OT) networks from IT networks so that a scanning or phishing foothold on the corporate side cannot pivot into control systems.

For security teams

• Review Microsoft Exchange and Microsoft 365 sign-in logs for password-spraying patterns consistent with EBurst: large numbers of failed authentications across many accounts from a small set of source IPs, followed by a successful login.
• Hunt for SoftEther VPN clients masquerading as conhost.exe or dllhost.exe, and audit for unexpected LSASS access consistent with Mimikatz credential dumping (MITRE ATT&CK T1003).
• Block and monitor for the seized indicators and associated infrastructure patterns, and use CISA's Eviction Strategies Tool (Playbook-NG and COUN7ER) to build a structured eviction plan if compromise is suspected.
• Enforce phishing-resistant MFA on Exchange/OWA and Microsoft 365 accounts to blunt password-spraying campaigns even when credentials are harvested.

For IoT device owners

• Change default credentials and apply firmware updates on routers, IP cameras, DVRs/NVRs, and network-attached storage devices — the device classes previously conscripted into Integrity Tech's Mirai-variant botnet.
• Disable remote administration interfaces that are not explicitly required, and place IoT devices on a segmented network isolated from business-critical systems.

Key Takeaways

1. The FBI and DOJ seized seven domains tied to Flax Typhoon's MicroScan and FishHub platforms, both allegedly built and operated by China-based Integrity Technology Group.
2. MicroScan is a large-scale, Python-based vulnerability scanner (1,300+ scripts) run through a Mirai-botnet relay layer; FishHub handled spear-phishing and data exfiltration, with several domains spoofing Outlook, YouTube, and LinkedIn.
3. Confirmed targets span critical infrastructure sectors — a South Carolina power utility, Japanese and Polish airports, and Taiwanese natural gas/electricity companies — plus universities and other organizations.
4. A companion joint advisory, AA26-281A, exposed a related Exchange/Microsoft 365 mailbox-theft campaign using the EBurst password-spraying tool, SoftEther VPN masquerading, and Mimikatz credential dumping.
5. This is the second public U.S. disruption of Integrity Tech infrastructure since a September 2024 botnet takedown, and officials emphasize the seizure disrupts current access rather than eliminating the threat.
6. Organizations should patch internet-facing software named in the advisory, audit Exchange/O365 logs for password-spraying patterns, and secure IoT devices that can be conscripted into supporting botnets.

Sources

• FBI disrupts Chinese hacking tools used to breach critical infrastructure — BleepingComputer
• Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools — U.S. DOJ, Western District of Pennsylvania
• FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions — The Hacker News
• FBI disrupts Flax Typhoon hacking tools used in global cyberattacks — Help Net Security