Flax Typhoon: Integrity Tech’s MicroScan and FishHub seized

On 8 October 2026 the US Department of Justice and the FBI announced the seizure of seven domains used to run two attack tools, MicroScan and FishHub. According to US authorities, they were developed and operated by Integrity Technology Group (Integrity Tech), a Chinese company with contracts with the Beijing government, and used by Chinese state-linked groups, in particular the one known as Flax Typhoon. The seizures were authorised by a court in the Western District of Pennsylvania.

The seizures came with a joint advisory from the FBI, CISA and NSA, also signed by Australia, Canada, Japan, New Zealand, the United Kingdom and Spain. According to The Record it runs to 58 pages and describes tools and techniques used over the past six years.

The two tools

MicroScan is a vulnerability-scanning platform. According to the advisory, it is a Python web application with more than 1,300 penetration-testing scripts, active since at least 2017. The scripts target widely used software: Apache Struts, Oracle WebLogic, Jenkins, WordPress, Juniper ScreenOS, OpenSSL, Rejetto HFS and others. For its scans, Integrity Tech relied on a botnet of IoT devices infected with a Mirai variant.

According to the court documents, on or about 26 April and 29 December 2022 MicroScan was used against the networks of a South Carolina power company, a multinational NGO, airports in Japan and Poland and at least two Taiwanese gas and power companies. The FBI did not say whether these organisations were breached. It did confirm successful intrusions after the scans at two Taiwanese universities, in August 2022 and March 2023.

FishHub supported spear-phishing campaigns. After initial access it downloaded a file that used the seized domains to retrieve further malicious programs. The malware listed files, searched for specific documents, compressed them and sent them to attacker-controlled servers, while also providing remote access to the network. The sources differ on the number of victims: according to BleepingComputer, a server linked to FishHub held data from more than 20 organisations, including six Taiwanese universities; according to The Record, The Register and SecurityWeek, the victims are around 20 universities in Taiwan.

The seized domains

• c0cc[.]cc: access to MicroScan, still online in September 2026 according to BleepingComputer;
• 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net: delivery of the FishHub malware, until March according to The Register;
• 98aiblog[.]com: linked to the SoftEther VPN software installed on compromised systems to keep access.

Techniques and exploited vulnerabilities

The advisory covers activity that overlaps with what is tracked as Flax Typhoon, Ethereal Panda, Red Juliett, Storm-0919 and UNC5007, and notes that not all of it is necessarily linked to Integrity Tech. Targets include government bodies, critical manufacturing, healthcare, IT, law enforcement, education and religious organisations. According to The Record, CISA and NSA point to poorly monitored edge devices as a typical target.

The chain described by the sources:

• reconnaissance with MicroScan and public tools such as Nmap, masscan, Fscan, dirsearch, WPScan, OneForAll and ksubdomain;
• initial access with command-line exploits, cross-site scripting and password spraying against Microsoft Exchange with the EBurst tool;
• persistence through SoftEther VPN;
• collection: email theft from on-premises systems and cloud services with the PHP script Curlc4.txt and the office-cli utility, and Active Directory data extraction with DC.ex. The FBI also found a web application that let third parties browse the stolen emails and, in some cases, access to the data was restricted to IP addresses in Xiamen.

According to BleepingComputer, eight vulnerabilities were exploited most often. The Register reports that CISA added the first five to the KEV catalogue:

• CVE-2015-3306 (ProFTPD, unauthorised file read);
• CVE-2015-5477 (ISC BIND, denial of service);
• CVE-2016-3081 (Apache Struts, remote code execution);
• CVE-2021-3199 (ONLYOFFICE Document Server, unauthorised file write);
• CVE-2023-22894 (Strapi, information disclosure);
• CVE-2014-6278 (GNU Bash, Shellshock);
• CVE-2019-11510 (Pulse Secure VPN, arbitrary file read);
• CVE-2021-22205 (GitLab, remote code execution).

The corresponding MITRE ATT&CK techniques (our mapping, not the advisory’s) are T1595.002 (vulnerability scanning), T1584.005 (botnet), T1190 (exploit public-facing application), T1566 (phishing), T1110.003 (password spraying), T1114 (email collection) and T1560 (archive collected data).

Background

This is not the first action against Integrity Tech. In September 2024 the Department of Justice dismantled its Mirai-based botnet: more than 200,000 devices according to BleepingComputer, over 260,000 according to The Record and The Register. The United States sanctioned the company in 2025 and, according to BleepingComputer, so did the United Kingdom; the European Union sanctioned it in 2026, in March according to SecurityWeek.

Impact for European and Italian companies

The sources mention no victims in Italy, but Polish airports are among the scanned targets and Spain co-signed the advisory. The exploited vulnerabilities are mostly old and well known: the risk concerns anyone still exposing unpatched Struts, WebLogic, GitLab, Pulse Secure VPN or Exchange servers. For NIS2 entities in energy, transport and healthcare, and for universities and research centres, it is a concrete case of vulnerability management on exposed systems.

What to do now

1. Look for the indicators in the joint advisory (IP addresses, domains, hashes) in DNS, proxy, firewall and mail logs, starting with the seven domains listed.
2. Patch the eight CVEs listed, starting with the five in the KEV catalogue, and check that no unsupported versions are exposed to the internet.
3. Disable unnecessary exposed services and review edge devices.
4. Enable multi-factor authentication on mail and VPN and look in Exchange logs for bursts of failed logins across many accounts.
5. Check for unauthorised SoftEther VPN installations and unusual transfers of compressed archives to the outside.

How ARXDOME helps

ARX Expose shows public services with known vulnerabilities, ARX Shield highlights already exploited vulnerabilities on monitored machines and ARX Horizon lets you search for indicators of compromise from the portal. ARX Sentry groups failed logins and bursts of attempts in the SOC pages, helping to spot password spraying.

Last updated: 9 October 2026