Flax Typhoon Lost Two Hacking Tools. Check Your Exposure
Matthew Leo · Published October 9, 2026 · Guides
U.S. authorities have seized seven domains used by two hacking platforms associated with China-based Integrity Technology Group. The tools, Microscan and FishHub, were used for vulnerability scanning, spear phishing and follow-on access to critical infrastructure and other networks, according to the U.S. Department of Justice.
This is not only a U.S. warning. The Canadian Centre for Cyber Security co-authored the technical advisory released with the operation, alongside agencies from the United States, United Kingdom, Australia, Japan, New Zealand and Spain.
What the seizure disrupted
The Justice Department says Integrity Tech used a Mirai-based botnet of compromised internet-connected devices to support Microscan. The tool looked for weaknesses in exposed systems. Named targets included a South Carolina power company, Japanese and Polish airports, Taiwanese energy companies, universities and a multinational non-governmental organization.
FishHub supported a different stage of the operation. Authorities allege it helped deliver malware after spear-phishing compromises, allowing remote access or the collection of selected files. The government says confirmed FishHub activity affected about 20 Taiwanese universities.
The announcement describes allegations in court documents, not a criminal conviction. China’s government has rejected U.S. accusations about state-backed hacking, Reuters reported.
The Canadian advisory is more important than the headlines
The joint October 8 cybersecurity advisory does not tell defenders simply to block the seized domains and move on. It describes a longer operating pattern that included internet-wide scanning, password spraying against Microsoft Exchange services, exploitation of web applications, installation of SoftEther VPN clients for persistence and theft of email data.
The advisory lists eight vulnerabilities that investigators observed in affected products, including flaws in Pulse Secure, GitLab, Apache ActiveMQ and other widely deployed software. Some date back more than a decade. That is useful context: the campaign did not depend on one new zero-day. It combined old weaknesses, exposed services and stolen credentials.
A practical response checklist
Canadian organizations do not need evidence of a direct targeting list before taking the advisory seriously. Government, healthcare, manufacturing and IT organizations are among its intended audiences.
- Inventory internet-facing services. Confirm why FTP, SSH, DNS, web, SOCKS proxy, VPN and remote-management services are exposed. Disable anything that is unused.
- Check the listed vulnerabilities. Compare the advisory’s affected products and CVEs with asset and patch records. A scanner result is not enough if an appliance has been missed by inventory.
- Review Exchange authentication. The actors used password spraying against several Exchange interfaces. Look for repeated failed sign-ins, legacy protocols and successful logins that do not match a user’s normal location or device.
- Hunt for unexpected SoftEther installations. The advisory says the actors sometimes renamed installers to resemble common Windows processes and configured the client to reconnect at startup.
- Load the indicators into security monitoring. The advisory provides downloadable STIX files and a larger appendix. Validate matches before blocking broadly because historical indicators can be reassigned.
- Require multifactor authentication. Apply it to externally accessible services wherever possible, then review accounts and tokens if compromise is suspected.
Why seizing domains is not the end
The operation removes infrastructure the alleged actors used, but it does not patch victim systems or rotate stolen credentials. It is also the second public disruption involving Integrity Tech. In 2024, the FBI said it disabled a botnet of more than 200,000 consumer devices associated with the company.
For defenders, the durable value is the evidence released with the seizure: techniques, file names, domains, vulnerabilities and mitigations that can be checked against local logs. Canadian organizations should preserve any matches, follow their incident-response plan and report significant incidents through the Canadian Centre for Cyber Security’s established channels.
Tags: Flax Typhoon, Integrity Technology Group, Microscan, FishHub, critical infrastructure