On October 8, 2026 the FBI and the Justice Department announced that they had seized infrastructure behind two hacking tools, Microscan and FishHub, which officials tie to the Chinese contractor Integrity Technology Group and the intrusion set that Microsoft and others track as Flax Typhoon. A joint advisory, AA26-281A, came from agencies in seven countries the same week.

Most of the coverage focused on the geopolitics. The more useful reading for a network defender is mechanical. The tools are plain: a web scanner packed with exploit scripts, a phishing kit, and a password sprayer. The vulnerabilities involved are largely years old. This post walks through how the pieces fit, which numbers are firm and which conflict between sources, and what the takedown does and does not accomplish.

What was announced

The seizures were court-authorized in the Western District of Pennsylvania and carried out through domain seizures, according to CyberScoop. The Hacker News counted seven seized domains, including c0cc[.]cc, which it says hosted Microscan. The Record, by contrast, says only that the Justice Department took “multiple websites,” and the Associated Press report mentioned no domains at all. That is a reporting difference, not a contradiction, but the count of seven rests on one outlet.

The advisory was co-published by the United States, the United Kingdom, Australia, Canada, Japan, New Zealand and Spain. The Record describes it as 58 pages, drawn from FBI incident-response work and covering tools used by Chinese actors over roughly six years. I did not retrieve the advisory itself, so everything below comes from press accounts of it.

Microscan: a scanner with a library of exploits

Microscan is described by The Hacker News as a Python-based web tool for reconnaissance and vulnerability scanning, believed to date to 2017. It reportedly includes more than 1,300 penetration-testing scripts aimed at products such as OpenSSL, Oracle WebLogic, WordPress, Juniper ScreenOS, Jenkins and Apache Struts. It was reachable through the domain c0cc[.]cc as recently as September 9, 2026.

The architecture is unglamorous. The operator feeds in a list of targets, the tool fires each script that matches the software it fingerprints, and the results tell the human operator where a foothold may be available. Open-source tools named alongside it, including Nmap, masscan, dirsearch and wpscan, handle discovery. CyberScoop says law enforcement tied Integrity Tech’s scanning to a Mirai-variant botnet of IoT devices, meaning the probing traffic originated from compromised cameras and routers instead of the operator’s own addresses.

That matters for defenders. Logs full of scans from residential IP ranges do not look like a state operation. They look like noise.

FishHub, EBurst and the mail theft

FishHub is the other seized tool. The Hacker News describes it as enabling exploitation through spear-phishing, with follow-on payloads that provide remote access or search for and exfiltrate specific files. Its confirmed victims include 20 Taiwanese universities, per both The Hacker News and The Record. CyberScoop lists Taiwanese universities among FishHub targets without a number.

Flax Typhoon: How Microscan and FishHub Worked, and What the FBI Takedown Changes - detail view

Alongside it, the advisory material mentions EBurst, an open-source Python brute-force tool. The Hacker News says the actors used it against Microsoft 365 accounts and then a command-line utility called office-cli to read mailbox data. The Record describes EBurst as targeting compromised Microsoft Exchange accounts, and CyberScoop speaks of password spraying against Exchange servers. The sources therefore disagree on whether the target was on-premises Exchange or Microsoft 365 or both, and the advisory would settle it.

Password spraying works by trying one or two common passwords across many accounts, so that no single account trips a lockout threshold. Stolen mail then provides credentials, contacts and context for the next phishing round.

Five old vulnerabilities in the catalog

On Thursday, October 8, CISA added five flaws to its Known Exploited Vulnerabilities catalog because Flax Typhoon was seen using them. Federal agencies have until October 11 to patch or stop using the affected software. The Hacker News lists them:

  • CVE-2015-3306, ProFTPD, CVSS 10.0: remote attackers can read and write arbitrary files using the site cpfr and site cpto commands.
  • CVE-2021-3199, ONLYOFFICE Docs, CVSS 9.8: a path traversal in an image-upload parameter when JSON Web Tokens are used can lead to remote code execution.
  • CVE-2023-22894, Strapi, CVSS 7.2: sensitive data exposed to an attacker with admin panel access through the query filter.
  • CVE-2016-3081, Apache Struts, CVSS 8.1: command injection through the method: prefix when Dynamic Method Invocation is enabled.
  • CVE-2015-5477, ISC BIND, CVSS 7.5: a remote attacker can cause denial of service through TKEY queries.

Reading the numbers

The advisory reportedly names eight vulnerabilities in total. Three more were already in the catalog: Shellshock in GNU Bash (CVE-2014-6278), an Ivanti Pulse Connect Secure file read (CVE-2019-11510) and a GitLab remote code execution flaw (CVE-2021-22205). Eight flaws with disclosure dates from 2014 to 2023 form the entry points. The newest is a 2023 entry.

Flax Typhoon: How Microscan and FishHub Worked, and What the FBI Takedown Changes - working context

The botnet figures come from the earlier case. The Hacker News says a database server tied to the Mirai-based botnet held records for over 1.2 million infected devices as of June 5, 2024, including more than 385,000 unique U.S. victims. On that date more than 260,000 devices were actively infected, about 126,000 of them in the United States. By my arithmetic, that is roughly 22 percent of recorded devices active at the snapshot, and the U.S. accounted for about 48 percent of the active ones.

Here the sources conflict. The AP says the September 2024 disruption involved more than 200,000 devices, while The Record and The Hacker News use more than 260,000. A “more than 200,000” statement is compatible with 260,000, so the difference may be rounding rather than error.

Persistence and what it implies

Once inside, the actors installed SoftEther VPN clients on victim devices, per The Hacker News. A VPN client the attacker controls turns a compromised host into an authenticated tunnel endpoint. Traffic then looks like encrypted VPN traffic instead of obvious command-and-control beacons.

The Record adds that the actors favor edge devices that are not closely monitored, which allows long-lived access, and that some stolen email data was restricted to IP addresses in Xiamen, China. CISA’s Chris Butera said Chinese government-affiliated actors continue to position themselves in critical infrastructure networks, including operational technology systems, “with the aim of disrupting critical functions at a future time of their choosing.” That statement is an assessment by an official and was not accompanied, in the coverage I read, by evidence of a specific planned attack.

A checklist drawn from the tools

The advisory guidance was not in the material I retrieved, so these steps are my inferences from how the tools behave, not quotes from it.

Flax Typhoon: How Microscan and FishHub Worked, and What the FBI Takedown Changes - supporting scene

First, find software on the edge of your network that is older than its patches. The catalog entries are old enough that a current vulnerability scanner will flag them if the software still exists. Second, look for SoftEther client processes or installs on hosts that should not have VPN software. Third, review authentication logs for many accounts failing against one or two passwords, and require multi-factor authentication on mail. Fourth, treat internet-facing document and CMS servers such as ONLYOFFICE and Strapi as exposed assets with owners and patch dates. Fifth, if you operate a sensitive or industrial network, check whether the management interface of any device is reachable from the internet.

What a takedown does, and does not

Seizing domains severs the operator’s access to a particular piece of infrastructure and warns the contractor that its tooling is observed. FBI officials said, per the AP, that they would keep watching how the company might rebuild. The U.S. sanctioned Integrity Tech in 2025 and has taken action against its botnet before, in 2024, and the activity described in this week’s advisory shows the group kept operating after those earlier actions.

The scanner is a Python program with public exploit logic. Rebuilding it is a matter of rehosting. The harder asset is the knowledge of which vulnerable systems exist. That list is not seized, and the old vulnerabilities do not disappear when a domain does. Beijing’s foreign ministry spokesperson Mao Ning, quoted by the AP, said China opposes disinformation and urged Washington to drop its double standards. The company’s own position was not stated in any source I read.

Frequently asked questions

What is Flax Typhoon?

Flax Typhoon is the name used by Microsoft and others for a China-linked intrusion set. The FBI says its true identity is Integrity Technology Group, a Beijing-based security company with Chinese government contracts. It is also tracked as Ethereal Panda and RedJuliett.

What are Microscan and FishHub?

Microscan is a Python-based web scanner with more than 1,300 exploit scripts, and FishHub is a spear-phishing tool that delivers payloads and remote access. The FBI and Justice Department seized the infrastructure supporting both on October 8, 2026.

Which vulnerabilities did CISA add to its catalog?

Five: CVE-2015-3306 (ProFTPD), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi), CVE-2016-3081 (Apache Struts) and CVE-2015-5477 (ISC BIND). Federal agencies were given until October 11, 2026.

Does the takedown stop Flax Typhoon?

Not by itself. It removes specific infrastructure, but the tools are reproducible and the vulnerable systems remain. Officials said they would monitor for rebuilding.

The instructive part of this case is how little novelty it contains. A scanner from 2017, a set of flaws mostly more than five years old, a password sprayer and a VPN client: the attack surface was neglected software, not unknown software. Takedowns are worth doing because they cost an adversary time and attention, but they do not patch anything. If one fact from the advisory deserves to reach your next maintenance window, it is that an entry list of eight old, catalogued vulnerabilities was enough to reach a power company, two airports and about twenty universities. Check your own edge for them before assuming the story is someone else’s.

Sources