What happened
On October 8, 2026, the Justice Department and FBI announced the court-authorized seizure of seven domains used to run two attack tools, Microscan and FishHub. According to court documents unsealed in the Western District of Pennsylvania, the tools were operated by staff of Integrity Technology Group (Integrity Tech), a Beijing company with Chinese government contracts. The activity is known in the private sector as Flax Typhoon (overlapping with Ethereal Panda and Red Juliett).
A judge authorized the seizures on October 6. The domains now show an FBI seizure notice. It's the second US action in two years against the company's infrastructure, per GovInfoSecurity.
The tools
Microscan: a Python web app with more than 1,300 penetration-testing scripts to find flaws in internet-facing systems. Scans were routed through a botnet of IoT devices infected with a Mirai variant, hiding their origin.
FishHub: a spear-phishing tool. After initial compromise, it pulled down malware providing remote access, file listings, document searches, compression and exfiltration to Integrity Tech servers. Confirmed victims: about 20 Taiwanese universities.
Targets, including Japan
Per the Justice Department, Microscan scanning targets included:
- a South Carolina power company (US);
- a multinational NGO;
- airports in Japan and Poland;
- Taiwanese critical infrastructure firms in gas and power;
- two Taiwanese universities, breached shortly after being scanned.
Scanning isn't breaching: the release doesn't say the Japanese airports were compromised, only scanned. But it shows Japanese infrastructure is on the radar, consistent with the seven-country advisory, including Japan, published the same week.
Seized domains
c0cc[.]cc (Microscan)
98aicai[.]com (FishHub)
98aicode[.]com (FishHub)
outlook3650[.]com (FishHub)
youtubecard[.]com (FishHub)
linkedinns[.]net (FishHub)
98aiblog[.]com (SoftEther VPN)
(Written with [.] so they don't become links.) Block them and search DNS and proxy logs for them.
What to do
- Search for the domains in historical DNS, proxy and email logs.
- Look for unauthorized SoftEther VPN on servers and endpoints.
- Shrink your exposed surface: Microscan-style scans find unpatched systems at scale.
- Secure routers, cameras and IoT: the botnet was built from such devices. Change default passwords and update firmware.
- Train against spear-phishing, especially in universities, energy and logistics.
- Remember: seizure takes down infrastructure but doesn't remove malware already inside networks.
Sources
- US Department of Justice: https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated
- BleepingComputer (Oct 8, 2026): https://www.bleepingcomputer.com/news/security/fbi-disrupts-chinese-hacking-tools-used-to-breach-critical-infrastructure/
- GovInfoSecurity: https://www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049
- Help Net Security (Oct 9, 2026): https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/
Want to check your network for signs of this campaign? KGA IT offers a free consultation: kga-it.com.