FBI seizes seven domains running Chinese hacking tools MicroScan and FishHub

The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. The seizures, announced on 8 October 2026 by the FBI and the Justice Department, targeted infrastructure supporting two platforms allegedly operated by China-based Integrity Technology Group.lanacion.com.ar+1

The seizures matter because they cut off the operating infrastructure of tools that scanned and breached critical infrastructure networks in the United States and other countries. Court documents unsealed on 8 October 2026 allege Integrity Technology Group holds contracts with the Chinese government, and U.S. authorities say the FBI has identified the firm as the actual identity of Flax Typhoon.bleepingcomputer.com

What the seizures covered

The FBI seized the c0cc.cc domain used by Integrity Tech to access the MicroScan platform, which law enforcement confirmed was online in September 2026. Five more seized domains — 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, and linkedinns.net — delivered FishHub malware as recently as March, infecting about 20 Taiwanese universities. A seventh seized domain, 98aiblog.com, was tied to the SoftEther VPN software installed on compromised systems to maintain remote access to victim networks. The seized domains now display FBI seizure notices identifying the Flax Typhoon hacking group and Integrity Technology Group.

MicroScan is a vulnerability-scanning platform developed by Integrity Tech to identify security weaknesses in targeted networks. According to an FBI seizure affidavit, the platform was used along with a botnet of internet-connected devices infected with Mirai malware to scan potential targets. The joint advisory says MicroScan is a Python-based scanner containing more than 1,300 penetration-testing scripts.

How the two tools worked

The scanning led to confirmed breaches at two Taiwanese universities whose networks were scanned using MicroScan in August 2022 and March 2023 and subsequently breached. Court documents allege that on 26 April 2022 and 29 December 2022, Flax Typhoon actors used MicroScan to scan a U.S. power company in South Carolina, a multinational non-governmental organisation, Japanese and Polish airports, and at least two Taiwanese critical infrastructure companies in the natural gas and power sectors.

FishHub conducted spear-phishing attacks and delivered additional malware to networks already compromised, giving attackers unauthorized remote access and the ability to search for and exfiltrate files to Integrity Tech servers. Investigators found data belonging to more than 20 organizations on a server linked to FishHub, including six universities in Taiwan. FBI special agent Adam James said in an affidavit he believed the tool was named FishHub because it facilitated phishing activity.

In coordination with the seizures, the FBI, CISA, NSA and international partners issued a joint cybersecurity advisory. The FBI and other government agencies in the U.S., U.K., Australia, Canada, Japan, New Zealand and Spain warned that Chinese government-linked attackers, enabled by Integrity Tech, use botnets, malware and intrusion tools to target organizations worldwide. The advisory says attackers targeted U.S. government agencies, critical manufacturing, healthcare, information technology, law enforcement, educational and religious organizations, as well as organizations in Southeast Asia, Africa and North America.

What the advisory says

Investigators identified eight commonly targeted vulnerabilities, including CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894, CVE-2014-6278, CVE-2019-11510 and CVE-2021-22205. Based on this activity, CISA added five of those CVEs to its Known Exploited Vulnerabilities Catalog. The attackers also used the open-source EBurst tool for password-spraying attacks against Microsoft Exchange servers. The activity overlaps with operations tracked as Flax Typhoon, Ethereal Panda and Red Juliett, though the agencies say not all activity may be linked to Integrity Tech.

Brett Leatherman, assistant director of the FBI's Cyber Division, said Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure. He said the Chinese government relies on contractors to expand the reach of their cyber operations, and that disrupting these organizations makes it harder for China-linked hackers to target American networks.

Officials respond to the seizures

FBI Cyber Division Deputy Assistant Director Jason Bilnoski said the operation renders the tools inoperable, saying, "We aim to remove the capability from the threat actors. We target their infrastructure, their money, and their tools." He called the hacking operation "indiscriminate and reckless." FBI San Diego Supervisory Special Agent Brett Lally said the department would continue to monitor for ways the company might rebuild its infrastructure.

From 2021 until its disruption, Flax Typhoon allegedly used a Mirai-based botnet to infect internet-connected devices, scan networks and launch attacks while hiding the PRC hackers' true IP addresses. In September 2024, the FBI announced it had disrupted a botnet associated with Flax Typhoon that installed malicious software on more than 200,000 consumer devices. The advisory contains indicators of compromise, including IP addresses, domains and malware hashes, and authorities are urging organizations to review them.