Reported by 14 outlets
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
Why this score
- Breadth
- 2.00 / 2.0 · 14 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.29 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 1.7 / 10 = base × recency + community
Desk analysis
The DOJ and FBI seized two hacking tools linked to the Chinese government-backed group Flax Typhoon: Microscan, a vulnerability scanner, and FishHub, a spearphishing tool. Both were created by Integrity Technology Group, a China-based firm sanctioned last year and targeted in a 2024 botnet takedown. The seizures were court-authorized in the Western District of Pennsylvania and paired with a multi-agency advisory warning that the actors combine automated scanning, botnets, and hands-on exploitation against critical infrastructure.
The advisory highlights cross-site scripting, password spraying on Microsoft Exchange, and persistence through VPN software. This action removes infrastructure rather than arresting operators, so the underlying threat group remains active. Monitor follow-up indictments or additional domain seizures targeting the Integrity Technology Group network.
Timeline
-
original reporting
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
cyberscoop.com · 5d ago · October 8th, 2026
The Justice Department and FBI announced that they had seized two hacking tools connected to the Chinese government-linked group Flax Typhoon and a China-based company that the U.S. government has repeatedly taken action against, including with a new multi-agency advisory Thursday. The domain name seizures were meant to deny hackers access to the vulnerability scanning tool Microscan and the spearphishing tool FishHub created by the Chinese firm Integrity Technology Group, which the United States sanctioned last year. The U.S. government in 2024 also made the company the focus of a takedown operation , saying it was behind a massive botnet. Authorities were granted the court-authorized seizures in the Western District of Pennsylvania, the FBI and DOJ announced Thursday in unsealing documents in the case. U.S. agencies paired the announcement of the seizures with an advisory from the FBI, Cybersecurity and Infrastructure Security Agency and National Security Agency. “Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including U.S. critical infrastructure sectors,” the advisory reads. “These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software
-
mentioned by www.ic3.gov
IC3: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data https://www. ic3.gov
www.ic3.gov · 5d ago · October 8th, 2026
-
update from www.cisa.gov
(cisa.gov) Joint Advisory Warns of China-Based Cybersecurity Firm Enabling Global Threat Activity Against Critical Infrastructure In brief -
www.cisa.gov · 5d ago · October 8th, 2026
(cisa.gov) Joint Advisory Warns of China-Based Cybersecurity Firm Enabling Global Threat Activity Against Critical Infrastructure In brief -
via Mastodon https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat
-
update from www.justice.gov
followup press release from DOJ: Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China
www.justice.gov · 5d ago · October 8th, 2026
followup press release from DOJ: Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China
via Mastodon https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated
-
update from malware.news
FBI seizes websites supporting Chinese contractor’s hacking operations
malware.news · 5d ago · October 8th, 2026
The Justice Department and FBI seized six internet domains supporting a major Chinese government contractor’s hacking operations, officials announced Thursday, alongside issuing a warning about the company’s role in targeting critical infrastructure worldwide. Microscan searched networks for security weaknesses, while FishHub supported deceptive emails and delivered malicious software that could steal files or let hackers remotely control affected systems, according to the DOJ. Officials said the activity has targeted government, manufacturing, healthcare, law enforcement and education organizations. “The [People’s Republic of China] relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” FBI Cyber Division Assistant Director Brett Leatherman said. “By exposing and disrupting these enablers,
-
mentioned by fawkes.rocks
Flax Typhoon: Integrity Tech hacking tools seized https:// fawkes.rocks/2026/10/08/flax-t yphoon-integrity-tech-hacking-tools-seized/
fawkes.rocks · 5d ago · October 8th, 2026
-
update from bleepingcomputer.com
FBI disrupts Chinese hacking tools used to breach critical infrastructure
bleepingcomputer.com · 5d ago · October 8th, 2026
"Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. MicroScan is a vulnerability-scanning platform developed by Integrity Tech to identify security weaknesses in targeted networks. According to an FBI seizure affidavit , the platform was used along with a botnet of internet-connected devices infected with Mirai malware to scan potential targets. These targets include a South Carolina
-
mentioned by www.bleepingcomputer.com
🤖 FBI seized 7 domains used by China state-sponsored Flax Typhoon to run two hacking tools, MicroScan and FishHub, deployed in intrusions ag
www.bleepingcomputer.com · 5d ago · October 8th, 2026
-
mentioned by cyberworldops.eu
The FBI seized seven domains supporting Flax Typhoon's MicroScan and FishHub scanning and malware platforms, attributed to Integrity Technol
cyberworldops.eu · 5d ago · October 8th, 2026
-
mentioned by hackread.com
FBI and DOJ have seized domains linked to Flax Typhoon, a China-linked hacking group accused of targeting US critical infrastructure. The op
hackread.com · 5d ago · October 8th, 2026
-
update from cyber.netsecops.io
📰 FBI: China-Linked Hackers Gave Third Parties Access to Stolen Emails FBI Advisory: China-linked hackers (Integrity Technology Group) ran a
cyber.netsecops.io · 5d ago · October 9th, 2026
📰 FBI: China-Linked Hackers Gave Third Parties Access to Stolen Emails FBI Advisory: China-linked hackers (Integrity Technology Group) ran a
via Mastodon https://cyber.netsecops.io/articles/fbi-china-linked-hackers-provided-third-party-access-to-stolen-emails/?utm_source=mastodon&utm_medium=social&utm_campaign=daily
-
update from zubiqo.com
While seven allied governments issued warnings about global network probing, the FBI seized seven domains tied to a Chinese contractor that
zubiqo.com · 5d ago · October 9th, 2026
While seven allied governments issued warnings about global network probing, the FBI seized seven domains tied to a Chinese contractor that
via Mastodon https://zubiqo.com/news/fbi-seizes-7-domains-linked-to-chinese-security-firm-powering-flax-typhoon-botnet-f6o7a4
-
mentioned by zubiqo.com
While seven allied governments issued warnings about global network probing, the FBI seized seven domains tied to a Chinese contractor that
zubiqo.com · 5d ago · October 9th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 FBI seized seven domains used by China-linked Flax Typhoon to operate two hacking tools, MicroScan and FishHub, in intrusions against crit
www.bleepingcomputer.com · 4d ago · October 9th, 2026
-
update from securityweek.com
US Disrupts Chinese State-Sponsored Hacking Tools
securityweek.com · 4d ago · October 9th, 2026
Integrity Tech, the US says, used a Mirai malware variant to build an IoT botnet that facilitated MicroScan’s use for reconnaissance against victims’ networks, including a US power company, NGOs, Japanese and Polish airports, and Taiwanese critical infrastructure entities and universities. FishHub enabled Integrity Tech’s clients to access victim networks remotely, search for specific files, and exfiltrate them. The US seized the domains the threat actors were using to access MicroScan and FishHub, including c0cc[.]cc, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net. In 2024, the US disrupted Integrity Tech’s Raptor Train botnet , and in 2025 sanctioned it for providing cybersecurity products to Chinese state-sponsored APTs such as Flax Typhoon. The European Union sanctioned the company in March 2026. A new joint advisory (PDF) from government agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain shows that MicroScan has been active since at least 2017
-
mentioned by www.fastcompany.com
FBI seizes Chinese hacking tools used for cyberattacks on critical U.S. infrastructure https://www.fastcompany.com/91621397/fbi-seizes-chine
www.fastcompany.com · 4d ago · October 9th, 2026
-
mentioned by www.bleepingcomputer.com
# FBI disrupts Chinese hacking tools used to breach critical infrastructure https://www. bleepingcomputer.com/news/secu rity/fbi-disrupts-ch
www.bleepingcomputer.com · 4d ago · October 9th, 2026
-
mentioned by diesec.com
FBI seized 7 domains behind Flax Typhoon's MicroScan and FishHub tools. The advisory points to Exchange password spraying and old CVEs, not
diesec.com · 1d ago · October 12th, 2026