FBI disrupts Flax Typhoon hacking tools used in global cyberattacks

1. Executive summary

The FBI and US Department of Justice seized seven domains used to operate Microscan and FishHub, two intrusion tools attributed to China-based Integrity Technology Group (Integrity Tech) and used in the Flax Typhoon campaign against critical infrastructure in the US, Taiwan, Japan, Poland and elsewhere. Microscan provided automated vulnerability scanning and reconnaissance; FishHub delivered spear-phishing and follow-on malware that gave Integrity Tech clients remote access or exfiltrated selected files. Roughly 20 Taiwanese universities are confirmed victims, and the operation scanned a South Carolina power company, airports in Japan and Poland, and Taiwanese gas and power companies. No CVE in this item carries a CVSS score, CISA KEV entry or EPSS value in the verified reference data, so the risk here is operational rather than patch-driven: the tools are disrupted, but the actor, the malware and the underlying access techniques remain available. EMEA financial services exposure is indirect but real, through Microsoft Exchange password spraying and cross-site scripting, VPN-based persistence, and third-party or subsidiary networks that share the scanned address space.

2. Regulatory framing

No DORA incident-reporting article is engaged by this item on its own: the source describes a law-enforcement disruption, not an incident at a client. If a client finds Microscan or FishHub artefacts in its own logs, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become live and the clock starts then.

3. Technical analysis & attack chain

This is a law-enforcement disruption, not a new vulnerability. The confirmed sequence, from the DOJ seizure warrant affidavit as reported:

1. Integrity Tech built a botnet of internet-of-things devices infected with a Mirai variant. The botnet provided the scanning capacity.
2. Microscan, a tool Integrity Tech developed, ran automated reconnaissance against victim networks to find weaknesses that Integrity Tech's clients would later exploit.
3. Between April and December 2022, Microscan scanned a power company in South Carolina, a multinational non-governmental organisation, airports in Japan and Poland, and Taiwanese natural gas and power companies.
4. Two Taiwanese universities were scanned in August 2022 and March 2023, and were breached shortly after each scan.
5. Integrity Tech accessed Microscan through c0cc[.]cc, one of the seized domains.
6. FishHub, the second tool and still in use as of March 2026, delivered spear-phishing to gain a foothold, then downloaded additional malware into the victim network.
7. That follow-on malware either gave Integrity Tech's clients unauthorised remote access, or searched for specific files and sent them to Integrity Tech-controlled servers.
8. At the two scanned universities, the attackers installed SoftEther VPN software to hold remote access, reached through the seized domain 98aiblog[.]com.

The joint advisory from the FBI and partner agencies describes the wider technique set: automated scanning tools, large-scale botnets and hands-on exploitation, with cross-site scripting and password spraying against Microsoft Exchange servers, persistence through VPN software, and exfiltration of email and credentials using scripts. Five of the seized domains (98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net) were used to deliver malware. The seventh, 98aiblog[.]com, served the SoftEther VPN channel. The FBI's working explanation for the name FishHub is that it facilitated phishing activity, per special agent Adam James's affidavit.

What this means for a defender: the scanning and phishing infrastructure is degraded, not the capability. The techniques named in the joint advisory (Exchange password spraying, XSS, VPN persistence, script-based credential and mail exfiltration) are the ones to hunt for in your own estate, because they do not depend on the seized domains.

Attribution caveat: the DOJ links the activity to Integrity Tech and to Flax Typhoon. Neither "Flax Typhoon" nor "Integrity Technology Group" has a MITRE ATT&CK profile in the verified reference data, so the state-sponsorship attribution is unconfirmed by that standard. Treat the actor naming as the US government's position, not as an independently corroborated mapping.

4. Mitigation & containment

P1 (within 24 hours)

• Block the seven seized domains at DNS and egress filtering if they are not already sinkholed: c0cc[.]cc, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net, 98aiblog[.]com. Seizure does not guarantee every resolver or cached record is clean.
• Hunt for SoftEther VPN on all endpoints and servers. It is the persistence mechanism named in the source. If it is present and not an approved, documented business tool, isolate the host and treat it as a compromise.
• Search Exchange and mail logs for password-spray patterns (many failed authentications across many accounts from few sources) and for script-driven mailbox access or export. The joint advisory names Exchange password spraying and script-based email and credential exfiltration.
• Enforce MFA on all externally reachable services, Exchange and VPN in particular. The FBI and partner agencies name MFA as a primary control.

P2 (within 72 hours)

• Disable unused services and ports on internet-facing systems, per the joint advisory.
• Sanitise web application inputs to close cross-site scripting paths on any externally facing application.
• Apply outstanding patches on internet-facing infrastructure. The source does not name a specific CVE, so prioritise by your own exposure on Exchange, VPN concentrators and web applications.
• Review remote-access software installed by third parties and subsidiaries. SoftEther was installed on victim networks, which means it can arrive through a provider rather than through your own change process.

P3 (within 7 days)

• Pull the joint FBI and partner agency advisory and ingest its IOC set into your detection stack. The source states the advisory includes indicators of compromise linked to Integrity Tech intrusions; those IOCs are not reproduced in this item.
• Add the named techniques to detection coverage: XSS attempts against web applications, password spraying against Exchange, and script-based mailbox export.
• Review whether any subsidiary, acquired entity or shared-service provider sits in the sectors named here (power, gas, airports, universities) and confirm their logging feeds into your SOC.

5. Indicators of compromise

Confidence caveat: the domain list is single-sourced to the DOJ seizure warrant as reported by Help Net Security. Verify against the joint advisory's IOC set before enforcing at scale.

domain  c0cc[.]cc
domain  98aicai[.]com
domain  98aicode[.]com
domain  outlook3650[.]com
domain  youtubecard[.]com
domain  linkedinns[.]net
domain  98aiblog[.]com

Behavioural indicators

6. Detection

The source gives tool names and a persistence mechanism but no file hashes, mutexes or command-line strings. The rules below key on the named artefacts and the behaviours the joint advisory describes. SoftEther is a legitimate product, so the Sigma rule is written to flag installation and service creation for triage, not as a verdict.

rule APT_FlaxTyphoon_Microscan_FishHub_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-09"
        reference = "https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/"
        description = "Detects strings associated with Microscan, FishHub and the seized Integrity Tech infrastructure"
    strings:
        $t1 = "Microscan" ascii wide nocase
        $t2 = "FishHub" ascii wide nocase
        $d1 = "c0cc.cc" ascii wide nocase
        $d2 = "98aicai.com" ascii wide nocase
        $d3 = "98aicode.com" ascii wide nocase
        $d4 = "outlook3650.com" ascii wide nocase
        $d5 = "youtubecard.com" ascii wide nocase
        $d6 = "linkedinns.net" ascii wide nocase
        $d7 = "98aiblog.com" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

title: SoftEther VPN Installation or Service Creation
id: 7c1f4a92-3b6e-4d21-9a58-0e2f6b8d4c11
status: experimental
description: Detects installation or service creation of SoftEther VPN, named in the DOJ seizure warrant as the persistence mechanism used at two scanned Taiwanese universities. SoftEther is a legitimate product; treat hits as triage leads.
author: Adverse Trace
date: 2026-10-09
references:

    - https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/
logsource:
    category: process_creation
    product: windows
detection:
    selection_proc:
        Image|endswith:

            - '\vpnclient.exe'
            - '\vpnserver.exe'
            - '\vpncmd.exe'
    selection_service:
        EventID: 7045
        ServiceName|contains: 'SoftEther'
    condition: selection_proc or selection_service
falsepositives:

    - Legitimate SoftEther deployments approved by IT
level: medium

7. Sources

• Help Net Security, "FBI disrupts Flax Typhoon hacking tools used in global cyberattacks", 2026-10-09. https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/
• The Hacker News, "FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions", 2026-10-09. https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html
• SecurityWeek, "US Disrupts Chinese State-Sponsored Hacking Tools", 2026-10-09. https://www.securityweek.com/us-disrupts-chinese-state-sponsored-hacking-tools/
• The Record (Recorded Future), "International coalition seizes tools used by cyber firm behind Flax Typhoon", 2026-10-09. https://therecord.media/flax-typhoon-china-tools-integrity-tech-international-takedown

8. Adverse Trace position

Adverse Trace assesses this as a disruption of capability, not of intent or of the actor. The seven seized domains and the two tools are degraded, but the techniques the joint advisory names (Exchange password spraying, cross-site scripting, VPN persistence, script-based credential and mail exfiltration) survive the takedown and remain available to Integrity Tech and its clients. We rate client impact as low to moderate for EMEA financial services: no CVE, no CVSS score and no CISA KEV entry is attached to this item in the verified reference data, and the confirmed victims are Taiwanese universities and infrastructure operators in the US, Japan and Poland. The exposure that matters to our clients is indirect, through third parties, subsidiaries and shared service providers in the scanned sectors, and through any SoftEther or similar remote-access software a provider has installed without a change record. Attribution to Flax Typhoon and Integrity Tech is the US government's position; neither actor has a MITRE ATT&CK profile in the verified reference data, so we treat the state-sponsorship link as unconfirmed. The domain list is single-sourced to the DOJ warrant as reported by Help Net Security; verify against the joint advisory's IOC set before enforcing. We will pull that joint advisory and its IOC set, add the named techniques to our detection content, and re-issue this advisory if the IOC set materially changes the picture.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.