FBI takes down Chinese Flax Typhoon hacking tools

The FBI has seized seven domains that the Chinese state-sponsored group Flax Typhoon used to operate two hacking tools, MicroScan and FishHub. According to U.S. authorities, they were deployed in attacks that breached critical infrastructure and other organizations around the world.

The operation targeted the infrastructure behind both platforms, which the Justice Department says were supplied by the China-based Integrity Technology Group (Integrity Tech), a firm holding contracts with the Chinese government. FBI Cyber Division assistant director Brett Leatherman said Beijing relies on contractors to extend the reach of its cyber operations, and that dismantling them makes it harder to target American networks.

Scanning and breaches

MicroScan is a Python-based vulnerability scanner packing more than 1,300 penetration-testing scripts aimed at widely used software such as Oracle WebLogic, Apache Struts, WordPress and Jenkins. It worked alongside a botnet of devices infected with Mirai malware to probe targets.

Those targets included a South Carolina power company, airports in Japan and Poland, Taiwanese gas and electricity providers, and universities. Per the FBI affidavit, the scanning led to actual breaches: two Taiwanese universities were scanned in August 2022 and March 2023 and subsequently compromised. The FBI did not reveal whether the named power companies and airports were successfully breached.

The second platform, FishHub, was used for spear-phishing and to deliver further malware into already-compromised networks. It granted remote access, let attackers hunt for specific files and exfiltrate data to Integrity Tech servers. On one such server investigators found data belonging to more than 20 organizations, including six Taiwanese universities.

Seized domains and guidance

The FBI seized c0cc.cc, used to reach MicroScan; five malware-delivery domains (98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net); and 98aiblog.com, tied to SoftEther VPN software used to keep remote access alive. All now display seizure notices.

In parallel, the FBI, CISA, NSA and international partners issued a joint advisory. The activity, overlapping with Flax Typhoon, Ethereal Panda and Red Juliett, hit U.S. government agencies, healthcare, IT and education, among others, plus organizations in Southeast Asia, Africa and North America. Commonly exploited flaws include eight CVEs, among them Shellshock and bugs in Pulse Secure VPN and GitLab.

This is not the first such takedown: in September 2024 the Justice Department dismantled an Integrity Tech Mirai botnet of more than 200,000 devices. The UK sanctioned the company in 2025 and the EU followed in 2026.

Source: Bleeping Computer