FBI Takes Down Domains Behind Flax Typhoon Scanning and Phishing Tools: Your Questions Answered
The FBI has seized seven domains tied to MicroScan and FishHub, tools U.S. officials link to Chinese contractor Integrity Tech and the Flax Typhoon hackers. Here is what was disrupted and what defenders should do.
U.S. authorities have struck at the tools behind one of China’s best-known state-backed hacking operations. Here are the key questions and what the public record says.
What did the FBI do?
It seized seven domains that supported two hacking platforms, MicroScan and FishHub. U.S. officials say both are run by Integrity Technology Group (Integrity Tech), a China-based company with Chinese government contracts, and were used by the group known as Flax Typhoon. The seized sites now show FBI seizure notices naming both.
What is MicroScan?
A vulnerability scanner. According to an FBI seizure affidavit, it was paired with a botnet of Mirai-infected devices to probe targets including a South Carolina power company, airports in Japan and Poland, Taiwanese gas and electricity companies, and universities. Two Taiwanese universities scanned with MicroScan in August 2022 and March 2023 were later breached. The FBI hasn’t said whether the named power, airport or energy targets were breached. Its access domain, c0cc.cc, was confirmed online in September 2026 and has been seized.
And FishHub?
A spear-phishing and malware-delivery platform used against networks already compromised. The malware let attackers search for and steal files to Integrity Tech servers. Investigators found data from more than 20 organizations on one FishHub-linked server, including six Taiwanese universities. Five delivery domains were seized: 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com and linkedinns.net. A seventh, 98aiblog.com, was tied to SoftEther VPN software used to keep remote access.
Who was targeted?
A joint advisory from the FBI, CISA, NSA and international partners lists U.S. government agencies, critical manufacturing, healthcare, IT, law enforcement, schools and religious organizations, along with organizations in Southeast Asia, Africa and North America. The activity overlaps with groups tracked as Flax Typhoon, Ethereal Panda and Red Juliett, though the agencies caution that not all of it may tie back to Integrity Tech.
Which weaknesses did they exploit?
MicroScan is Python-based and carries more than 1,300 penetration-testing scripts aimed at software such as Oracle WebLogic, Apache Struts, WordPress and Jenkins. Investigators flagged eight frequently targeted flaws, many of them years old:
- CVE-2015-3306 (ProFTPD file read)
- CVE-2015-5477 (ISC BIND denial of service)
- CVE-2016-3081 (Apache Struts code execution)
- CVE-2021-3199 (ONLYOFFICE DocumentServer file write)
- CVE-2023-22894 (Strapi information disclosure)
- CVE-2014-6278 (Bash “Shellshock” code execution)
- CVE-2019-11510 (Pulse Secure VPN file read)
- CVE-2021-22205 (GitLab code execution)
The attackers also used the open-source EBurst tool to password-spray Microsoft Exchange servers, along with tools for stealing email, harvesting Active Directory credentials and moving data out. The FBI found a custom web app that let third parties read stolen email without touching the hacked accounts.
Has this group been disrupted before?
Yes. In September 2024 the Justice Department took down an Integrity Tech-run Mirai botnet of more than 200,000 consumer devices. The UK sanctioned the company in 2025 and the European Union followed in 2026.
Lawrence Abrams laid out the seizures and the joint advisory for BleepingComputer, which is the basis for this summary.
What this means for your company
The striking detail is how old many of these flaws are. State-backed attackers scan the whole internet for forgotten servers running unpatched software, and small businesses get caught in the same sweep as power companies.
- Find what you expose to the internet: old VPNs, FTP servers, self-hosted GitLab or WordPress. Patch it or shut it off.
- Require multifactor authentication on email and block legacy sign-in methods that password spraying relies on.
- Check the advisory’s indicators of compromise, or ask your IT provider to, against your firewall and DNS logs.
- Retire end-of-life systems. A 2015 vulnerability is only a threat if 2015 software is still running.
Need help finding forgotten internet-facing systems or checking your logs against the latest advisories? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
