FBI Seizes Flax Typhoon Tools; Operators May Rebuild

On October 8, 2026, the FBI and Justice Department seized domains supporting Microscan and FishHub, tools linked to the hacking activity known as Flax Typhoon. The court-authorized action, disclosed in the Western District of Pennsylvania, cut off known routes to a vulnerability scanner and a spear-phishing tool allegedly operated by China-based Integrity Technology Group. The tools had been used against critical infrastructure and other networks in the United States and abroad.

The Associated Press account says officials described the tools as inoperable; FBI Cyber Division Deputy Assistant Director Jason Bilnoski called the hacking operation “indiscriminate and reckless,” and FBI San Diego Supervisory Special Agent Brett Lally said investigators would watch for attempts to rebuild the infrastructure. The seizure interrupts the named tools’ operations. For defenders, the unresolved question is whether earlier intrusions left access that remains usable through other means.

Microscan found openings across several sectors

Microscan worked at the reconnaissance stage, identifying vulnerable systems that Integrity Tech’s clients could later exploit. The Justice Department’s account says a botnet of internet-connected devices infected with a Mirai variant helped run the scans. Integrity Tech accessed the scanner through the seized domain c0cc[.]cc. Removing that domain denies the operators a known route to the tool, but it does not change the condition of systems the scanner had already identified.

The named scanning targets included a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and power companies, Taiwanese universities and a multinational nongovernmental organization. Those are targets of scanning, not a list of confirmed breaches. A scan can reveal an exposed service or likely vulnerability; gaining access requires a subsequent exploit, stolen credential or other intrusion method. That distinction limits what an organization can conclude merely from appearing in the target list.

A joint cybersecurity advisory describes Microscan as a Python-based web application with more than 1,300 scripts for testing websites for specific vulnerabilities, used by the associated actors as early as 2017. Its examples include services such as Oracle WebLogic, WordPress, Jenkins and Apache Struts. The same advisory describes other scanning tools in the actors’ repertoire, which helps explain why losing access to Microscan need not end their reconnaissance.

FishHub carried an intrusion beyond phishing

FishHub served a different purpose. Prosecutors allege that it facilitated spear phishing and downloaded additional malware after an initial network compromise. That malware could provide Integrity Tech’s clients with unauthorized remote access, or search for specified files and send them to company-controlled servers. The tool therefore connected the attempt to gain entry with payload delivery and activity on a compromised network.

Approximately 20 Taiwanese universities were confirmed victims of FishHub activity. Five seized domains helped deliver its malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net. Historical connections to those addresses may help an investigator establish whether a payload reached a network. A connection alone does not establish that the malware ran, that files left the organization or that access persisted.

The distinction between the tools also matters when interpreting the action. Microscan helped identify possible entry points; FishHub helped exploit targets through phishing and deliver malware after compromise. Taking away their domains interferes with those specific routes. It does not reverse an earlier download or remove a remote-access capability already installed on a victim device.

What the domain seizure changes for defenders

Seizing a domain can prevent operators from using that address to reach a service or deliver a payload. It can also turn a familiar indicator into a useful marker for reviewing older logs. Its effect is narrower inside an affected network: installed software, stolen credentials and vulnerable services require separate investigation and remediation. A defender’s immediate question is whether the known infrastructure merely contacted the network or enabled a lasting foothold.

The activity associated with Integrity Tech offers reasons to look beyond the seized addresses. Investigators observed the actors installing SoftEther VPN clients on victim devices and configuring them to reconnect at startup, sometimes naming installers conhost.exe or dllhost.exe to resemble ordinary Windows files. They also described password attacks against Microsoft Exchange accounts and tools for collecting email and credentials. Those methods can leave evidence in hosts, account activity and network logs even when the original delivery domain is unavailable.

For a potentially affected organization, the relevant distinction is between disruption of an operator’s infrastructure and eviction from its own systems. Reviewing the named domains alongside host and account evidence can establish the scope of any intrusion; isolating compromised devices and removing unauthorized access address what may already be present. Patching exposed services, limiting unused access and using multifactor authentication address routes described in the investigation that a domain seizure cannot close on a defender’s behalf.

The next test is whether infrastructure reappears

The action follows an earlier U.S. disruption of Integrity Tech’s Mirai-based botnet. The repeat action shows why the possibility of rebuilding is material: investigators can disable identified infrastructure while the people and techniques behind it remain. The seized domains are concrete losses for the operators, but the longer-term effect will be measured by whether fresh scanning, phishing or replacement services emerge.

Defenders also have a separate measure of impact: whether systems reached before the seizure still show unauthorized access. That evidence may appear in unusual VPN connections, account activity or outbound transfers rather than in traffic to a seized domain. The next meaningful development is therefore observable activity after October 8—either replacement infrastructure tied to the operators or the absence of renewed activity across the networks they targeted.