FBI seizes domains behind Flax Typhoon’s MicroScan and FishHub tools

FBI seizes domains powering Flax Typhoon’s MicroScan and FishHub

In a coordinated operation, the FBI took control of seven domains that the Chinese state‑sponsored group Flax Typhoon used to run its MicroScan vulnerability‑scanner and the FishHub malware‑delivery platform.

Why the seizure matters

MicroScan, a Python‑based platform with more than 1,300 pen‑testing scripts, was paired with a Mirai botnet to probe critical‑infrastructure targets—from a South Carolina power utility to airports in Japan and Poland. The scans paved the way for successful breaches at two Taiwanese universities in 2022 and 2023.

FishHub served as the spear‑phishing dropper, installing remote‑access tools, exfiltrating data, and leaving behind files from over 20 organizations, including six Taiwanese universities.

Technical snapshot

• Seized domains: c0cc.cc (MicroScan gateway, live Sep 2026); 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net (FishHub delivery); 98aiblog.com (tied to SoftEther VPN).
• Tools in the toolkit: MicroScan, FishHub, Mirai botnet, SoftEther VPN, EBurst password‑spraying utility.
• Eight CVEs most frequently weaponized: CVE‑2015‑3306, CVE‑2015‑5477, CVE‑2016‑3081, CVE‑2021‑3199, CVE‑2023‑22894, CVE‑2014‑6278, CVE‑2019‑11510, CVE‑2021‑22205.
• Target sectors listed in the joint advisory: U.S. government agencies, critical manufacturing, healthcare, IT, law enforcement, education, religious institutions, plus entities in Southeast Asia, Africa and North America.

Who’s in the cross‑fire

The advisory flags more than 20 victims, among them six Taiwanese universities, a South Carolina electric utility, and unnamed airports and natural‑gas providers. Law‑enforcement notes that the same infrastructure also supported attacks against Microsoft Exchange servers via the open‑source EBurst tool.

Immediate defensive steps

1. Patch all software referenced in the CVE list—especially Oracle WebLogic, Apache Struts, WordPress, Jenkins, ONLYOFFICE DocumentServer, Strapi, GNU Bash, Pulse Secure VPN, and GitLab.
2. Block outbound traffic to the seized domains and any newly registered look‑alikes.
3. Inspect network logs for Mirai‑style scanning patterns (massive SYN floods to IoT ports, repeated telnet/SSH attempts).
4. Review Exchange server authentication logs for password‑spraying bursts; enforce MFA and strong password policies.
5. Audit VPN configurations, particularly SoftEther deployments, for unauthorized client certificates or back‑door entries.
6. Enable threat‑intel feeds that reference Flax Typhoon, MicroScan, and FishHub signatures.

Broader context

Earlier, the Department of Justice crippled a Mirai botnet of over 200,000 compromised consumer devices operated by Integrity Tech. The United Kingdom (2025) and the European Union (2026) have both sanctioned the company, underscoring the growing geopolitical focus on supply‑chain and botnet abuse.