Court documents unsealed this week describe an operation that quietly ran for years: a Chinese contractor built scanning and phishing tools, rented them out to state-backed operators, and used a sprawling botnet of consumer devices to hide every move. The FBI says it has now pulled the plug on seven domains that kept that engine running.
The takedown is small in terms of infrastructure but big in what it exposes about how Beijing's contractors package offensive cyber capabilities for reuse. Two tools — Microscan and FishHub — sit at the center of the case, and the trail of victims stretches from South Carolina utilities to Taiwanese universities.
Key facts
- The FBI seized seven domains linked to Flax Typhoon hacking tools operated through China-based Integrity Technology Group.
- Two tools were involved: Microscan (a vulnerability scanner paired with a Mirai-based IoT botnet) and FishHub (a spear-phishing and post-compromise framework).
- Documented scan victims include a US power company in South Carolina, Japanese and Polish airports, Taiwanese gas and power firms, and at least two Taiwanese universities that were later breached.
- A joint advisory from agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain added five CVEs to CISA's Known Exploited Vulnerabilities Catalog.
- About 20 Taiwanese organizations, including roughly six universities, had data recovered from a FishHub-linked server.
- Five domains delivered the FishHub malware (98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net); one hosted the operator panel (c0cc[.]cc); one (98aiblog[.]com) supported a SoftEther VPN used for persistence.
What Flax Typhoon actually ran
According to helpnetsecurity.com and bleepingcomputer.com, Microscan was the recon half of the operation. Integrity Tech reportedly built a botnet out of internet-of-things devices infected with a Mirai variant, then pointed it at targets to scan for weaknesses. The FBI's seizure affidavit, as reported by theregister.com, ties two universities in Taiwan — one in Hsinchu, one in Puli Township — to scans in August 2022 and March 2023 that were followed by confirmed intrusions.
Bleepingcomputer.com notes the FBI stopped short of confirming successful breaches at every named target, including the South Carolina utility and the Japanese and Polish airports. That matters: scanning is not the same as exploitation, and the public record is careful about that line.
FishHub, by contrast, is the break-in half. Spear-phishing dropped an initial loader, which then used the five flagged domains to fetch extra code. That second-stage malware either handed attackers remote access or hunted for specific files and shipped them back to Integrity Tech servers, according to helpnetsecurity.com. An FBI agent's affidavit explained the name bluntly: "Based on my training and experience I believe the tool was named FishHub because it facilitated phishing activity."
One unusual wrinkle in the kit: the SoftEther VPN connection. As bleepingcomputer.com describes, attackers installed the legitimate SoftEther software on compromised university networks and routed traffic through the seized 98aiblog[.]com domain — a clean way to keep a foothold without deploying a custom backdoor on every host.
Our analysis
The contractor model is the real headline. Per bleepingcomputer.com, FBI Cyber Division assistant director Brett Leatherman framed Integrity Tech as a private enabler that "expands the reach and scale" of PRC operations. That is consistent with a pattern that has become normal over the past few years: governments buy deniability by routing offensive work through registered companies, often with overlapping staff and shared infrastructure.
The tool split — scan with one tool, exploit with another — is also worth noting. Microscan handles volume; FishHub handles value. Together they form an assembly line, not a single bespoke operation. For defenders, that means even a small disruption (seven domains is not many) can ripple through the workflow if the scanner feeds the phishers.
The trade-off is that domain seizures do not reach the IoT devices already enrolled in the Mirai-based botnet. Those bots keep scanning until they are cleaned or replaced. CISA and FBI advisories typically tell owners how to identify infected gear, but compliance is voluntary.
Finally, the international scope is unusually broad. Joint advisories are routine; one spanning eight governments (the US, UK, Australia, Canada, Japan, New Zealand, Spain, plus partners) signals that the targeting pattern — utilities, airports, NGOs, universities — matched observations across multiple allied networks. Theregister.com flags that five CVEs are now in the Known Exploited Vulnerabilities Catalog, which means US federal agencies are on the clock to patch.
What it means for you
Say you run a small IT team at a regional utility or hospital, and your perimeter has a few IP cameras or HVAC controllers you rarely touch. This case shows exactly how those devices get drafted into a scanner. Step one: inventory the unmanaged IoT gear on your network — the printer in the break room, the badge readers, the cameras — and segment them off anything sensitive. Step two: turn on multi-factor authentication everywhere, especially on Microsoft Exchange and any webmail front end, because password spraying and credential theft are recurring moves in advisories like this one. Step three: subscribe to CISA's KEV catalog feed or an automated mirror; the five CVEs added this week directly correspond to weaknesses the group is known to probe.
Home users get a smaller, but still real, lesson. If your router or smart-device admin password is still the default, change it. Mirai-class botnets still rely on devices that were never reconfigured after unboxing.
What to watch next
Watch whether the unsealed documents lead to indictments against named Integrity Tech employees, and whether allied governments impose sanctions or travel restrictions as they did with prior PRC enablers. Watch the CISA KEV page — new CVEs tied to this actor will likely land there before they show up in vendor changelogs. And watch the SoftEther angle: legitimate software abused as a persistence layer is harder to detect than a custom implant, and defenders should expect more of it.
The bottom line: seven domains is a meaningful, but not decisive, blow to Flax Typhoon's pipeline. The bigger contribution is the public map of how a private contractor packaged and rented offensive tooling — a blueprint that defense teams can now study.
Key takeaways
- Flax Typhoon's toolkit was a two-stage operation: IoT-driven scanning (Microscan) followed by spear-phishing and data theft (FishHub).
- The leaked court docs name specific victim sectors — utilities, airports, universities, NGOs — useful for prioritizing your threat model.
- Domain seizures cut the operator's workflow but do not clean the Mirai-infected devices already enrolled in the botnet.
- Five newly added CISA KEV entries should drive an immediate patch sweep across Exchange, web apps, and any internet-exposed admin panels.
Frequently asked questions
What were the Flax Typhoon hacking tools used for?
Microscan mapped vulnerabilities across target networks using a Mirai-infected IoT botnet, and FishHub delivered malware through spear-phishing to maintain access and steal files.
Who is alleged to have built and operated the tools?
The FBI and DOJ point to China-based Integrity Technology Group, which they say holds contracts with the Chinese government, with the activity linked to a tracked group called Flax Typhoon.
Which organizations were listed as victims in the court documents?
The filings name a South Carolina power company, Japanese and Polish airports, Taiwanese gas and power firms, two Taiwanese universities later breached, and about 20 Taiwanese organizations whose data was found on a FishHub-linked server.
What should security teams do right now?
Patch the five CVEs recently added to CISA's Known Exploited Vulnerabilities Catalog, turn on multi-factor authentication, sanitize web application inputs, disable unused services and ports, and segment unmanaged IoT devices off sensitive networks.
Does a domain seizure end the threat?
It disrupts the current infrastructure and exposes the playbook, but infected IoT devices remain in the botnet, and operators can rebuild around new domains — so ongoing patching and monitoring are still required.