The Justice Department and FBI seized two hacking tools, Microscan and FishHub, and several domains used by Integrity Technology Group, a China-based company tied to the Flax Typhoon hacking activity. Agencies in seven countries issued a joint advisory Oct. 8.
What the Justice Department Seized
The Justice Department announced the seizures on Oct. 8, after unsealing court documents in the Western District of Pennsylvania. It said Integrity Technology Group, known as Integrity Tech, is a company based in the People’s Republic of China with Chinese government contracts, and that actors it enabled are known as Flax Typhoon.
Microscan is a vulnerability scanning tool. The Justice Department said Integrity Tech used it, in part through a botnet of internet-connected devices infected with a variant of the Mirai malware, to find weaknesses that clients could later exploit. Known targets included a South Carolina power company, a multinational nonprofit, airports in Japan and Poland, natural gas and power companies in Taiwan and two Taiwanese universities.
FishHub is a spear phishing tool. After an initial break-in, it downloaded more malware that gave clients remote access or searched for files to copy to Integrity Tech servers. About 20 Taiwanese universities were confirmed victims. The department seized one domain tied to Microscan and five tied to FishHub, which delivered the malicious files.
The release describes seizures, not criminal charges against the company or named individuals. The FBI’s San Diego and Baltimore field offices and its Cyber Division investigated, with help from Japan’s National Police Agency.
How the Company Model Works
Law enforcement officials framed the case around a business that sells access. FBI Cyber Division Assistant Director Brett Leatherman said in the release that China “relies on contractor and enabling companies” to expand its hacking reach. The release quotes Mark Remily, special agent in charge of the FBI San Diego Field Office, on the bureau’s “unwavering commitment in disrupting PRC state-sponsored cyber criminals.”
The seizure is the second Justice Department action against Integrity Tech in about two years. In September 2024, the department said it carried out a court-authorized disruption of Integrity Tech’s Mirai botnet, which included more than 200,000 consumer devices in the United States and worldwide. A botnet of that size lets operators route scans and attacks through ordinary home routers and cameras rather than through infrastructure that can be tied to them.
U.S. Attorney Troy Rivetti of the Western District of Pennsylvania said the seizures are the second disruption of Integrity Tech’s operations “in as many years,” according to the release.
What the Joint Advisory Says
The FBI, the Cybersecurity and Infrastructure Security Agency and the National Security Agency published a joint cybersecurity advisory, designated AA26-281A, on Oct. 8. Cyber agencies from the United Kingdom, Australia, Canada, Japan, New Zealand and Spain also cosealed it. The advisory says Integrity Tech employees acquire or build cyber tools for sale or use, host infrastructure and compromise victim networks worldwide, and that the actors use tactics consistent with Flax Typhoon, Ethereal Panda and Red Juliett. It adds that those actors may also work outside Integrity Tech.
The advisory says the actors operate a custom web application that lets third parties read stolen email, with users passing arguments in a web address to view mail from specific accounts. It describes a PHP bot called Curlc4 that pulls mail through the Microsoft Exchange Web Services interface and a command-line tool called office-cli that automates ongoing theft from Outlook
365 accounts using stored credentials. Victims of email theft included government organizations, law enforcement agencies, healthcare systems and religious institutions, mostly in Southeast Asia. The advisory lists victims across Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health and Information Technology, and in the United States, Southeast Asia, Africa and North America. It also lists law enforcement, education and religious organizations as targets.
The earliest documented access described dates to mid-January 2021. Microscan itself is older than that. The advisory says it is a Python web application with more than 1,300 penetration-testing scripts that has been in use since 2017. By a count of years, that is nine years of use before the seizure.
What Organizations are Told to Do
The advisory names EBurst, an open-source password-guessing tool for Exchange and Office 365 interfaces, along with the open-source scanners BBScan, dirsearch, Fscan, masscan, NMAP, OneForAll and wpscan. For persistence it points to SoftEther VPN clients disguised as system files named conhost.exe or dllhost.exe, and to a tool named DC.exe that copies Active Directory credentials from domain controllers.
It lists eight older vulnerabilities the actors exploited: CVE-2014-6278, CVE-2015-3306, CVE2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199 and CVE-2023-
22894. Most are years old, which means systems that never received patches remain open. The recommended defenses are plain. The agencies tell organizations to require multifactor authentication for webmail and VPNs, replace default passwords, patch promptly and retire end-of-life products. They also advise sanitizing user input to block cross-site scripting, monitoring cloud accounts for connected applications that read email and watching for unexpected Active Directory replication. The advisory notes that some listed indicators of compromise date to 2016, so defenders should vet them before blocking.
Why the Case Matters beyond Taiwan
The confirmed victims listed in the release skew toward Taiwan, but the targets also include a U.S. power company and airports in Japan and Poland. The advisory says the actors have gone after sectors ranging from health care to manufacturing.
A tool like Microscan works as a preattack service, so the harm is in what customers do with the scan results. Assistant Attorney General John Eisenberg of the National Security Division said in the release that the United States “will not allow China or its proxies” to operate against U.S. interests with impunity in cyberspace.
