--- url: "https://www.xcademia.com/news/doj-and-fbi-seize-microscan-and-fishhub-tools-linked-to-flax-typhoon" title: DOJ and FBI Seize Microscan and FishHub Tools Linked to Flax Typhoon description: "DOJ and FBI seize Microscan and FishHub, tools allegedly linked to Flax Typhoon and cyberattacks targeting critical infrastructure." publishedAt: "2026-10-09T10:20:27.404+00:00" updatedAt: "2026-10-10T03:43:31.974317+00:00" type: news category: cybersecurity source_name: U.S. Department of Justice source_url: "https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated" tags: - "#Cybersecurity" - "#FlaxTyphoon" - "#CriticalInfrastructure" - "#SpearPhishing" - "#CyberThreatIntelligence" - "#MiraiBotnet" - "#FBI" - "#ThreatDisruption" --- # DOJ and FBI Seize Microscan and FishHub Tools Linked to Flax Typhoon > The U.S. Justice Department and FBI seized two cyber tools allegedly used by China-linked actors to scan networks and facilitate spear-phishing intrusions targeting critical infrastructure and organisations worldwide. Source: **U.S. Department of Justice** · 9 October 2026 ## DOJ and FBI Seize Microscan and FishHub Tools Linked to Flax Typhoon The U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have seized two cyber tools allegedly used by China-linked actors to scan computer networks and facilitate targeted intrusions. The tools, known as **Microscan and FishHub**, were reportedly used in operations targeting critical infrastructure and other organisations in the United States and abroad. The court-authorised actions aim to disrupt access to the tools and limit their further use. According to court documents unsealed in the Western District of Pennsylvania, the tools were operated or used by individuals working for Integrity Technology Group, a China-based company with contracts from the People's Republic of China government. U.S. authorities associate the individuals with **Flax Typhoon**, a cyber threat group previously linked to operations against organisations and networks internationally. The DOJ announcement describes the seizures as part of continuing efforts to disrupt cyber infrastructure allegedly used in operations against U.S. and foreign networks. ## What Are Microscan and FishHub? Microscan and FishHub allegedly served different roles in cyber operations. Microscan was used for network reconnaissance and vulnerability scanning, while FishHub allegedly supported spear-phishing activity and follow-on malware deployment. The distinction matters because scanning can help an operator identify potential weaknesses, while phishing can provide a route into a victim's environment. ### Microscan: Network Scanning and Reconnaissance According to the DOJ, Microscan was used to scan victim networks for vulnerabilities that clients could potentially exploit later. The tool reportedly operated through a botnet and other infrastructure. Some of the botnet's devices were Internet of Things (IoT) products infected with a variant of Mirai malware. Mirai is malware historically associated with compromising connected devices and incorporating them into botnets. The court documents identify scanning activity involving several types of organisations and infrastructure, including: - A U.S. power company based in South Carolina - A multinational non-governmental organisation - Airports in Japan and Poland - Natural gas and power infrastructure companies in Taiwan - Two Taiwanese universities The presence of an organisation on the scanning list does not, by itself, establish that the organisation was successfully compromised. The DOJ announcement describes scanning activity and alleged operational use of the tool, not confirmed successful intrusions against every named category of target. As part of the disruption, authorities seized the domain **c0cc[.]cc**, which was identified as an access path associated with Microscan. ### FishHub: Spear Phishing and Follow-On Malware FishHub allegedly supported a different stage of cyber operations by facilitating network exploitation through spear phishing. Spear phishing involves targeted messages designed to persuade a particular person or organisation to take an action that can expose a system or account. According to the DOJ, after an initial compromise, FishHub could download additional malware. The malware allegedly enabled clients of Integrity Technology Group to obtain unauthorised remote access or search for files and transmit them to servers controlled by Integrity Tech. The DOJ identified approximately 20 Taiwanese universities as confirmed FishHub victims. Authorities seized five domains associated with FishHub's malware delivery infrastructure: - **98aicai[.]com** - **98aicode[.]com** - **outlook3650[.]com** - **youtubecard[.]com** - **linkedinns[.]net** These domains are included here as reported in the DOJ announcement. Their inclusion is intended to help readers identify the infrastructure described by authorities, not to suggest that visiting any particular domain necessarily indicates a compromise. ## How the Alleged Cyber Operations Worked The DOJ's description outlines two related but distinct functions. Microscan allegedly helped identify potentially vulnerable networks. FishHub allegedly supported initial access through spear phishing and subsequent activity involving additional malware. The reported process can be summarised as follows: 1. **Reconnaissance:** Microscan scanned networks for potential vulnerabilities. 2. **Potential exploitation:** Findings could help operators identify systems for further activity. 3. **Initial access:** FishHub allegedly facilitated spear-phishing operations. 4. **Malware deployment:** Additional malware could be downloaded after an initial compromise. 5. **Post-compromise activity:** The malware allegedly enabled remote access or file discovery and transfer. This is a summary of the activity described by the DOJ. It should not be interpreted as a claim that every target experienced every stage or that every scanning attempt led to a successful intrusion. ## ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791540460962-info-1--204-.webp) ## Integrity Technology Group and Flax Typhoon The DOJ states that the individuals associated with Microscan and FishHub worked for Integrity Technology Group, a China-based company with contracts from the Chinese government. Authorities associate those individuals with Flax Typhoon. These are allegations described in court documents. They should not be presented as a final judicial determination of responsibility. The case also illustrates how cyber operations can involve multiple layers of infrastructure, including scanning tools, compromised connected devices, phishing delivery mechanisms, malware and remote-access capabilities. Disrupting one or more of these components can limit access to resources allegedly used in an operation. The DOJ's announcement does not provide a complete technical inventory of every system involved or quantify the overall impact of the Microscan and FishHub seizures. ## A Previous Disruption Targeted a Mirai Botnet The latest action follows an earlier disruption involving Integrity Technology Group infrastructure. In September 2024, the DOJ announced a disruption targeting the company's Mirai botnet. According to that earlier announcement, the botnet involved more than **200,000 consumer devices in the United States and worldwide**. The September 2024 action and the October 2026 seizures are separate enforcement events. The earlier figure describes the botnet targeted in 2024 and should not be treated as the number of devices involved in the Microscan and FishHub operations. The latest seizures extend the public record of U.S. efforts to disrupt infrastructure that authorities associate with Integrity Tech-linked cyber activity. ## ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791540482937-info-2--186-.webp) ## FBI Advisory Provides Information for Network Defenders Alongside the seizures, the FBI and U.S. and international partners published a cybersecurity advisory containing indicators of compromise (IOCs). IOCs are technical clues that security teams can use when investigating whether systems may have interacted with suspicious infrastructure or activity. Depending on the advisory, these can include items such as domain names, IP addresses, file indicators or other technical artefacts. Organisations that may be affected should consult the original advisory for its actual indicators and guidance rather than relying on a summary article. Security teams can use the advisory as a starting point for reviewing relevant network activity and determining whether further investigation is warranted. An indicator match requires context and validation; it does not automatically prove that an organisation has been compromised. ## What Organisations Should Review The DOJ announcement does not prescribe a complete remediation checklist for every organisation. However, the reported activity highlights several practical areas that defenders can review as part of their existing security processes. - **Review the official advisory:** Check the FBI's published indicators and recommendations against the organisation's environment. - **Investigate suspicious scanning:** Look for unusual network reconnaissance, repeated connection attempts and activity involving exposed services. - **Review phishing-related incidents:** Examine suspicious messages, reported user interactions and evidence of malware downloads. - **Validate remote access:** Investigate unexpected remote sessions and access patterns that do not align with authorised activity. - **Check for unusual file activity:** Review relevant logs for suspicious file discovery, collection or transfers. - **Assess connected devices:** Where applicable, review the security and network behaviour of IoT devices, particularly those that may be exposed to the internet. These are general defensive considerations informed by the reported activity, not a substitute for the specific technical guidance in the FBI advisory. ## ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791540518964-info-3--174-.webp) ## Investigation and International Cooperation The investigation involves the FBI's San Diego and Baltimore field offices, working with the FBI Cyber Division. The DOJ also credited prosecutors and supporting agencies involved in the case. These included an assistant U.S. attorney in the Western District of Pennsylvania, a trial attorney from the Justice Department's National Security Division, an assistant U.S. attorney from the District of Maryland and Japan's National Police Agency. The participation of U.S. and foreign partners reflects the cross-border nature of the alleged activity, which involved infrastructure and targets across multiple countries. The court-authorised seizures are a disruption measure. The announcement does not establish the final outcome of any criminal proceedings or disclose every detail of the investigation. ## Conclusion The seizure of Microscan and FishHub highlights two distinct components of the cyber activity described by U.S. authorities: vulnerability scanning to identify potential weaknesses and spear-phishing-related activity that allegedly enabled follow-on malware deployment. For security teams, the most actionable next step is to review the FBI's official advisory and assess relevant telemetry in the context of their own environments. The reported targets span critical infrastructure, educational institutions and other organisations, reinforcing the importance of monitoring both reconnaissance activity and signs of post-compromise access. The case remains grounded in allegations described by the DOJ and court documents. Further technical or investigative details were not fully disclosed in the announcement. ## Original source https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated ## Tags `#Cybersecurity` · `#FlaxTyphoon` · `#CriticalInfrastructure` · `#SpearPhishing` · `#CyberThreatIntelligence` · `#MiraiBotnet` · `#FBI` · `#ThreatDisruption` --- ## About this content This Markdown news article is the citation-grade twin of [DOJ and FBI Seize Microscan and FishHub Tools Linked to Flax Typhoon](https://www.xcademia.com/news/doj-and-fbi-seize-microscan-and-fishhub-tools-linked-to-flax-typhoon). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/doj-and-fbi-seize-microscan-and-fishhub-tools-linked-to-flax-typhoon - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt