U.S. Seizes Domains of Microscan and FishHub Tools Linked to Flax Typhoon
The U.S. Department of Justice and FBI, acting under court authorization, seized seven domains used by the Microscan and FishHub tools. According to officials, they were used to scan for vulnerabilities, conduct spear-phishing and gain subsequent access to networks.
The U.S. Department of Justice (DOJ) and FBI announced on October 8, 2026, that they had seized seven internet domains under court authorization. The action was intended to disrupt the operation of Microscan and FishHub, which U.S. authorities link in court filings to Integrity Technology Group and activity known in the private sector as Flax Typhoon.
According to the DOJ, the domains were part of infrastructure used for vulnerability scanning and spear-phishing operations. The FBI and partner agencies also issued joint cybersecurity advisory AA26-281A, including indicators of compromise for network administrators.
Microscan and FishHub reportedly had different roles
Unsealed court filings describe Microscan as a tool used to scan for vulnerabilities. According to the DOJ, targets it scanned included an energy company in South Carolina, airports in Japan and Poland, and Taiwanese organizations in the gas and energy sectors.
Scanning alone does not confirm successful intrusion into every system examined this way. The DOJ refers to scanning and, in some cases, intrusions, but the available materials do not indicate that all of the listed entities were compromised.
According to the department, FishHub served a different function. After spear-phishing, it delivered additional malware intended to enable attackers to remotely access an infected device or search for and exfiltrate files. The DOJ said approximately 20 Taiwanese universities were among the confirmed victims.
U.S. authorities cite ties to China
The DOJ claims that Integrity Technology Group has contracts with the Chinese government. Activity attributed to its actors is referred to in the cybersecurity sector as Flax Typhoon. These findings are based on claims by U.S. authorities in court documents. The available materials did not include an independent response from the Chinese government or Integrity Technology Group.
U.S. authorities describe the operation as the second publicly announced technical action by the United States against Integrity Tech infrastructure since September 2024. The current seizure targeted specific domains, but it has not been confirmed that this permanently halted the actors’ activities or that they lost all alternative tools and servers.
What network administrators should check
For organizations, the new joint advisory AA26-281A is practically important. Administrators should compare the available indicators of compromise with network logs, email activity and security records from their systems. Given the nature of the targets described, particular attention is warranted for critical infrastructure and education entities, as well as organizations with ties to Taiwan.
It remains to be seen whether the indicators or recommendations in the advisory will be expanded, whether Integrity Technology Group or Chinese authorities will respond to the allegations, and whether signs emerge that the actors have moved to new domain infrastructure.
Sources
- U.S. Department of Justice – Confirms the date and legal basis of the action, the domain seizures, descriptions of the tools, the stated targets and FishHub’s confirmed victims.
- Associated Press – Independently confirms the FBI and DOJ announcement, the names of the tools and their alleged ties to Integrity Technology Group and Flax Typhoon.
- BleepingComputer – Adds details about the seven seized domains and their roles in the Microscan and FishHub infrastructure.
Verified and updated: 10/09/2026 06:20
