Flax Typhoon Integrity Tech Domain Seizure

The Flax Typhoon Integrity Tech case reached a new stage on October 8, when the FBI seized seven domains behind two hacking tools, MicroScan and FishHub. The Justice Department says a Chinese company with government contracts, Integrity Technology Group, operated them. The joint advisory published alongside gives defenders a short list: password spraying against Microsoft Exchange, persistence through VPN software, and old software that is still exposed.

What Happened

The Flax Typhoon Integrity Tech seizures were court-authorized and announced on October 8, 2026. According to the Justice Department, Integrity Tech built a botnet of devices infected with a Mirai variant and used MicroScan, a vulnerability scanner, to map victim networks for weaknesses its clients could exploit later. Scan targets in the court documents include a South Carolina power company, airports in Japan and Poland, Taiwanese energy companies and two Taiwanese universities, both breached soon after. The FBI did not say whether the other targets were compromised.

The second tool, FishHub, delivered spear-phishing payloads and then pulled more malware onto the victim network, giving remote access or sending chosen files to Integrity Tech servers. The Justice Department says about 20 Taiwanese universities are confirmed victims; the court affidavit refers to files from more than 20 entities on a FishHub server, six of them Taiwanese universities. Five seized domains delivered the malware, among them lookalikes of Microsoft, LinkedIn and YouTube (outlook3650[.]com, linkedinns[.]net, youtubecard[.]com). A seventh, 98aiblog[.]com, was tied to SoftEther VPN software left on victims for persistent access. It is the second Justice Department disruption of Integrity Tech, after a 2024 takedown of a botnet of more than 200,000 devices.

The advisory (AA26-281A), issued with agencies in the UK, Australia, Canada, Japan, New Zealand and Spain, describes scanning tools, cross-site scripting and password spraying on Exchange servers, VPN software for persistence, and scripts that exfiltrate email and credentials. BleepingComputer’s summary adds that the spraying used the open-source tool EBurst and lists eight commonly targeted flaws: CVE-2015-3306 (ProFTPD), CVE-2015-5477 (BIND), CVE-2016-3081 (Struts), CVE-2021-3199 (ONLYOFFICE), CVE-2023-22894 (Strapi), CVE-2014-6278 (Shellshock), CVE-2019-11510 (Pulse Secure) and CVE-2021-22205 (GitLab). The Hacker News reports CISA added the first five to its KEV catalog on October 8 with an October 11 due date; the other three were already listed. We read the advisory through this coverage; the full indicator list is in the advisory itself.

Why It Matters

There is no zero-day here. The newest CVE dates from 2023, and the Exchange access runs on guessed passwords, not an Exchange flaw. A contractor-run scanner finds what has stayed exposed for years, and clients choose targets from the result. The advisory names government, critical manufacturing, healthcare, IT and education among the sectors, with victims in North America, Southeast Asia and Africa. The coverage we read names no European victims.

Assessment: a Mittelstand company with on-premises Exchange, an older VPN appliance and a forgotten file-transfer or developer server matches the profile. We have no evidence of German victims. Our Exchange CVE-2026-62911 post showed how much on-premises Exchange still faces the internet in Germany, and our Azure CLI password spray post covered the same technique against cloud sign-ins. A seizure removes domains, not tools.

What You Should Do Now

1. Take the indicators from AA26-281A and search DNS, proxy, mail and firewall logs for the seven seized domains and the lookalikes. FishHub was still running in March 2026, so look back at least that far.
2. Check Exchange and directory sign-in logs for password spraying: many accounts, few attempts each. Enforce MFA for all mail access and disable legacy authentication where it is not needed.
3. Inventory internet-facing services from the eight-CVE list and patch or remove anything still vulnerable.
4. Search endpoints and servers for unexpected SoftEther VPN software and VPN sessions to servers you do not know.
5. Treat a domain match alone as a lead, not proof. Escalate to incident response when you find real access or outbound transfers.

DIESEC Perspective

The defense is unglamorous: an accurate inventory of what faces the internet, MFA on mail, and log retention that reaches back to March. If you cannot say what an external scanner saw of you last week, that inventory is the first job.

Not sure which of your internet-facing services would show up in a scan like this? Contact DIESEC for a rapid external exposure review and Exchange sign-in log check.

Sources: U.S. Department of Justice | BleepingComputer | Help Net Security | The Register
Published: 2026-10-12 | Category: Nation-State & APT | ~4 min read