FBI Seizes Domains Linked to Chinese State-Sponsored Hacking Group Flax Typhoon
The FBI has seized seven domains tied to Flax Typhoon, a Chinese state-sponsored hacking group, disrupting two hacking tools MicroScan and FishHub used in cyberattacks against critical infrastructure and organizations worldwide. The domains were operated by Integrity Technology Group (Integrity Tech), a China-based contractor with alleged ties to the Chinese government.
The tools were deployed to scan for vulnerabilities and breach networks, including targets in the U.S., Japan, Poland, Taiwan, and other countries. MicroScan, a Python-based vulnerability scanner with over 1,300 penetration-testing scripts, was used alongside a Mirai malware botnet to identify weaknesses in systems running software like Oracle WebLogic, Apache Struts, WordPress, and Jenkins. The FBI confirmed successful breaches at two Taiwanese universities in August 2022 and March 2023, though it did not disclose whether other named targets such as a South Carolina power company, Japanese and Polish airports, and Taiwanese energy firms were compromised.
FishHub, the second tool, facilitated spear-phishing attacks and malware delivery, granting attackers remote access to victim networks for data exfiltration. Investigators found stolen files from over 20 organizations, including six Taiwanese universities, on a server linked to the tool. The seized domains c0cc.cc, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, and 98aiblog.com were used to deliver malware and maintain persistence via SoftEther VPN.
The operation, conducted in coordination with CISA, NSA, and international partners, also led to a joint cybersecurity advisory detailing the group’s tactics. The advisory revealed that Flax Typhoon targeted U.S. government agencies, critical manufacturing, healthcare, IT, law enforcement, education, and religious organizations, as well as entities in Southeast Asia, Africa, and North America. The attackers exploited eight known vulnerabilities, including CVE-2015-3306 (ProFTPD), CVE-2019-11510 (Pulse Secure VPN), and CVE-2021-22205 (GitLab), and used tools like EBurst for password-spraying attacks on Microsoft Exchange servers.
This is not the first disruption of Integrity Tech’s operations. In September 2024, the U.S. dismantled a 200,000-device Mirai botnet linked to the group, while the UK and EU sanctioned the company in 2025 and 2026, respectively, for cyberattacks targeting Western allies. The seized domains now display FBI seizure notices, marking another blow to China’s cyber espionage infrastructure.
Integrity360 cybersecurity rating report: https://www.rankiteo.com/company/integrity360
"id": "INT1791498424",
"linkid": "integrity360",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Education',
'location': 'Taiwan',
'name': 'Two Taiwanese universities (August 2022 and '
'March 2023 breaches)',
'type': 'Educational Institution'},
{'industry': 'Education',
'location': 'Taiwan',
'name': 'Six Taiwanese universities (data found on '
'FishHub server)',
'type': 'Educational Institution'},
{'industry': 'Energy',
'location': 'United States',
'name': 'South Carolina power company',
'type': 'Critical Infrastructure'},
{'industry': 'Transportation',
'location': ['Japan', 'Poland'],
'name': 'Japanese and Polish airports',
'type': 'Critical Infrastructure'},
{'industry': 'Energy',
'location': 'Taiwan',
'name': 'Taiwanese energy firms',
'type': 'Critical Infrastructure'},
{'industry': 'Public Sector',
'location': 'United States',
'name': 'U.S. government agencies',
'type': 'Government'},
{'industry': 'Manufacturing',
'location': ['United States',
'Southeast Asia',
'Africa',
'North America'],
'name': 'Critical manufacturing organizations',
'type': 'Private Sector'},
{'industry': 'Healthcare',
'location': ['United States',
'Southeast Asia',
'Africa',
'North America'],
'name': 'Healthcare organizations',
'type': 'Private Sector'},
{'industry': 'Information Technology',
'location': ['United States',
'Southeast Asia',
'Africa',
'North America'],
'name': 'IT organizations',
'type': 'Private Sector'},
{'industry': 'Public Sector',
'location': ['United States',
'Southeast Asia',
'Africa',
'North America'],
'name': 'Law enforcement agencies',
'type': 'Government'},
{'industry': 'Religious',
'location': ['United States',
'Southeast Asia',
'Africa',
'North America'],
'name': 'Religious organizations',
'type': 'Non-Profit'}],
'attack_vector': ['Vulnerability Exploitation',
'Spear-Phishing',
'Malware Delivery',
'Password-Spraying'],
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': 'Files from over 20 '
'organizations',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Sensitive organizational data']},
'description': 'The FBI has seized seven domains tied to Flax Typhoon, a '
'Chinese state-sponsored hacking group, disrupting two hacking '
'tools MicroScan and FishHub used in cyberattacks against '
'critical infrastructure and organizations worldwide. The '
'domains were operated by Integrity Technology Group '
'(Integrity Tech), a China-based contractor with alleged ties '
'to the Chinese government. The tools were deployed to scan '
'for vulnerabilities and breach networks, including targets in '
'the U.S., Japan, Poland, Taiwan, and other countries.',
'impact': {'data_compromised': 'Stolen files from over 20 organizations, '
'including personally identifiable information',
'identity_theft_risk': 'High (due to PII exposure)',
'operational_impact': 'Network breaches, remote access to victim '
'networks, data exfiltration',
'systems_affected': ['Critical infrastructure',
'Government agencies',
'Universities',
'Healthcare',
'IT',
'Manufacturing',
'Law enforcement',
'Religious organizations']},
'initial_access_broker': {'backdoors_established': 'SoftEther VPN for '
'persistence',
'entry_point': ['Vulnerability exploitation',
'Spear-phishing',
'Malware delivery'],
'high_value_targets': ['Critical infrastructure',
'Government agencies',
'Universities']},
'investigation_status': 'Ongoing',
'motivation': ['Cyber Espionage',
'Data Exfiltration',
'Critical Infrastructure Disruption'],
'post_incident_analysis': {'corrective_actions': ['Domain seizures',
'Disruption of hacking '
'tools',
'International '
'coordination'],
'root_causes': ['Exploitation of known '
'vulnerabilities',
'Use of hacking tools (MicroScan, '
'FishHub)',
'State-sponsored cyber espionage']},
'references': [{'source': 'FBI Seizure Notice'},
{'source': 'Joint Cybersecurity Advisory (CISA, NSA, FBI)'}],
'regulatory_compliance': {'legal_actions': 'UK and EU sanctions (2025, 2026)'},
'response': {'communication_strategy': 'Joint cybersecurity advisory issued',
'containment_measures': 'Domain seizures, disruption of hacking '
'tools (MicroScan and FishHub)',
'law_enforcement_notified': 'FBI',
'third_party_assistance': 'CISA, NSA, and international '
'partners'},
'stakeholder_advisories': 'Joint cybersecurity advisory detailing Flax '
'Typhoon’s tactics',
'threat_actor': 'Flax Typhoon (Chinese State-Sponsored Hacking Group)',
'title': 'FBI Seizes Domains Linked to Chinese State-Sponsored Hacking Group '
'Flax Typhoon',
'type': ['State-Sponsored Cyber Espionage', 'Cyberattack'],
'vulnerability_exploited': ['CVE-2015-3306 (ProFTPD)',
'CVE-2019-11510 (Pulse Secure VPN)',
'CVE-2021-22205 (GitLab)',
'Oracle WebLogic',
'Apache Struts',
'WordPress',
'Jenkins']}