International coalition seizes tools used by cyber firm behind Flax Typhoon

1. Executive summary

An international coalition led by the U.S. Department of Justice seized multiple websites and infrastructure belonging to Beijing-based Integrity Tech, a contractor that supplied scanning and phishing tooling to China-linked intrusion activity tracked as Flax Typhoon. The action targeted two named tools, Microscan (vulnerability reconnaissance, in use since 2017) and FishHub (phishing and post-compromise malware delivery), and was accompanied by a 58-page joint advisory from the FBI, CISA, NSA and partners in Australia, Japan, the U.K., Spain, New Zealand and Canada. Named victims include a South Carolina power company, Japanese and Polish airports, Taiwanese natural gas and power companies, and roughly 20 Taiwanese universities. The direct risk to EMEA financial services is low from the takedown itself, but the advisory confirms a sustained campaign against edge devices and on-premise email that maps onto infrastructure many EMEA firms still run. No CVE is named in the source material and no CISA KEV entry is associated with this item, so this advisory carries no patch deadline.

2. Regulatory framing

No DORA Art. 17, 18, 19, 29 or 30 obligation is engaged by this item on the facts available. There is no incident at an EMEA client, no confirmed concentration exposure and no contractual change reported.

3. Technical analysis & attack chain

This is a law-enforcement and inter-agency action, not a newly disclosed vulnerability. The source material describes the tooling and the campaign at a level of detail that supports defensive action but does not give file hashes, C2 addresses, or version numbers. The attack chain below reflects what the advisory and reporting confirm.

1. Integrity Tech acquires, builds, sells or hosts tooling used by several China-linked groups. Microscan is the reconnaissance tool; FishHub is the phishing and malware-delivery tool.
2. Microscan conducts automated vulnerability scanning against internet-facing websites and services. It has been in use since 2017 and was originally written as penetration-testing scripts to scan websites for specific vulnerabilities.
3. Scanned and confirmed-vulnerable systems are exploited by Chinese state-linked operators. The source states Microscan enabled "widespread vulnerability scanning and, in some cases, intrusions."
4. FishHub is used to run phishing campaigns and, once a network is breached, to download malware onto the victim's systems. The remote access FishHub provides was used specifically against roughly 20 universities in Taiwan.
5. Target selection concentrates on edge devices that are not closely monitored, because they allow long-term, secret access. CISA and NSA state this is the company's typical approach.
6. A separate tool, EBurst, targets compromised email accounts on Microsoft Exchange servers. It uses multiple interfaces for password spraying and password guessing.
7. Additional tooling is designed to access email, calendars and contacts. The FBI recovered an archived email database the actors used to target victim email accounts; the actors collect credentials and exfiltrate email data from both on-premise systems and cloud-based services.
8. Observed victims of the email data theft include government organisations. The source text is truncated at this point, so the full victim list is not available.

Confirmed victim sectors named in the source: a South Carolina power company, Japanese and Polish airports, Taiwanese critical infrastructure companies in natural gas and power, and about 20 Taiwanese universities. CISA's acting executive assistant director for cybersecurity, Chris Butera, stated that Chinese government hackers "continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing." That is a positioning statement about intent, not a report of OT disruption in this campaign.

Confidence caveats. The attribution of Integrity Tech to the PRC Ministry of State Security rests on U.S. government statements and court documents reported by The Record; it is not corroborated by an independent source in the material provided. Neither "Flax Typhoon" nor "Integrity Tech" has a MITRE ATT&CK profile in our reference data, so the attribution is treated as unconfirmed for the purposes of this advisory. The technical detail on Microscan, FishHub and EBurst comes from the joint advisory as summarised in a single news source; the underlying 58-page advisory was not available to us at time of writing. Treat the tool capabilities as single-sourced until the primary advisory is reviewed.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every internet-facing edge device in the estate: VPN concentrators, firewalls, load balancers, mail gateways, remote-access appliances. For each, confirm whether it is covered by monitoring. The campaign's stated advantage is edge devices that are not closely monitored, so an unmonitored edge device is the exposure to close first.
• Confirm whether any on-premise Microsoft Exchange server is still exposed to the internet. EBurst targets Exchange email accounts with password spraying and password guessing across multiple interfaces. If on-premise Exchange is internet-facing, restrict it to VPN or a reverse proxy with MFA in front of it.
• Check authentication logs on Exchange and any internet-facing email interface for password spraying patterns: many failed authentications across many accounts from a small set of source addresses in a short window. The source does not provide a threshold, so tune to your baseline.

P2 (within 72 hours)

• Review mail-flow and mailbox audit logs for the exfiltration pattern described: credential collection followed by bulk access to email, calendars and contacts from on-premise systems and cloud services. The FBI recovered an archived email database used to target victim accounts, which indicates the actors retained collected data rather than only reading it in place.
• If you run Microsoft Exchange on-premise, verify that current cumulative updates are applied and that any legacy authentication protocols (IMAP, POP, SMTP AUTH, Exchange Web Services with basic auth) are disabled where not operationally required. The source does not name a specific CVE or patch level, so this is a hardening step, not a vulnerability remediation.
• Add the tool names Microscan, FishHub and EBurst to threat-hunting queries and to any vendor intelligence feed you consume. These are tool names, not file artefacts, so they will surface in reporting and vendor signatures rather than in raw telemetry.

P3 (within 7 days)

• Obtain and read the 58-page joint advisory published by the FBI, CISA, NSA and partner agencies. It is the primary source for tool behaviour and any indicators. Our advisory is based on secondary reporting of it.
• Review third-party risk assessments for any edge appliance or email platform vendor to confirm the assessment covers the vendor's own security posture, not only contractual and availability terms. This is the DORA Art. 28 and NIS2 Art. 21(2)(d) angle.
• Add the exposure classes named in this campaign (unmonitored edge devices, on-premise email interfaces) to the scope of your next resilience test cycle under DORA Art. 24.

No vendor fix is named in the source material because no specific vulnerability is named. Do not treat this advisory as a patch instruction.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths, registry keys) are present in the source material. The source names tools and behaviours only.

Tool and actor names are not machine-pivotable atomic indicators and are not placed in the copyable block.

Behavioural indicators

6. Detection

The source material names tools and behaviours but provides no file artefacts, command-line flags, mutex names, registry keys or filenames. A YARA rule built on tool names would detect reporting about the threat, not the threat itself, so no YARA rule is emitted.

A Sigma rule is possible for the one behaviour with a clear log source: password spraying against Exchange authentication.

title: Suspected Password Spraying Against Exchange Authentication
id: 7f3c1a92-4b8e-4d21-9c6a-2e5f8b1d0a34
status: experimental
description: Detects a high volume of failed authentication attempts across many distinct accounts from a small set of source addresses, consistent with the password spraying and password guessing behaviour attributed to the EBurst tool in the October 2026 joint advisory on Integrity Tech tooling.
author: Adverse Trace
date: 2026-10-09
references:

  - https://therecord.media/flax-typhoon-china-tools-integrity-tech-international-takedown
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
  timeframe: 5m
  condition: selection | count(distinct TargetUserName) by IpAddress > 20
falsepositives:

  - Misconfigured service accounts or applications retrying with stale credentials
  - Vulnerability scanners performing authenticated checks
level: medium

Tune the distinct-account threshold to your environment. The source does not give a threshold, so 20 distinct accounts from one source address in five minutes is a starting point, not a validated figure.

7. Sources

• The Record, "International coalition seizes tools used by cyber firm behind Flax Typhoon", https://therecord.media/flax-typhoon-china-tools-integrity-tech-international-takedown, published 2026-10-08.

The 58-page joint advisory referenced in the source (FBI, CISA, NSA, and partners in Australia, Japan, the U.K., Spain, New Zealand and Canada) was not available to us at time of writing and is not cited by URL here.

8. Adverse Trace position

Adverse Trace assesses the direct risk to EMEA financial services clients from this takedown as low, because the action removes tooling rather than introducing a new exposure, and because no CVE, no CISA KEV entry and no EMEA victim is named in the source material. The residual risk is the campaign pattern the advisory documents: unmonitored edge devices and on-premise Exchange email, both of which remain common in EMEA financial infrastructure and both of which the source states were used for long-term access and email data theft. We treat the Integrity Tech attribution to the PRC Ministry of State Security as unconfirmed for our purposes, since neither named actor has a MITRE ATT&CK profile in our reference data and the attribution rests on U.S. government statements reported by a single outlet. We will obtain the 58-page joint advisory and reissue this note with tool-level indicators if it contains artefacts we can turn into detection content. Clients running internet-facing Exchange or unmonitored edge appliances should treat the P1 items in section 4 as the priority this week.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.