CTI · reviewed · 2026-10-09

DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub

Full story & timeline

MITRE ATT&CK

• T1595 Active Scanning Reconnaissance
• T1566 Phishing Initial Access
• T1110 Brute Force Credential Access
• T1133 External Remote Services Persistence

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://cyberscoop.com/doj-fbi-seize-flax-typhoon-hacking-tools-microscan-fishhub/
• https://malware.news/t/fbi-seizes-websites-supporting-chinese-contractor-s-hacking-operations/126273#post_1
• https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat
• https://www.ic3.gov/CSA/2026/261008.pdf
• https://www.bleepingcomputer.com/news/security/fbi-disrupts-chinese-hacking-tools-used-to-breach-critical-infrastructure/
• https://fawkes.rocks/2026/10/08/flax-typhoon-integrity-tech-hacking-tools-seized/
• https://cyberworldops.eu/en/fbi-seizes-seven-domains-supporting-flax-typhoon-scanning-and-malware
• https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated
• https://hackread.com/fbi-seizes-flax-typhoon-hacking-tools-china/
• https://zubiqo.com/news/fbi-seizes-7-domains-linked-to-chinese-security-firm-powering-flax-typhoon-botnet-f6o7a4
• https://cyber.netsecops.io/articles/fbi-china-linked-hackers-provided-third-party-access-to-stolen-emails/?utm_source=mastodon&utm_medium=social&utm_campaign=daily