FBI seizes Flax Typhoon hacking tools, charges Beijing firm
The FBI seized Flax Typhoon's MicroScan scanner and FishHub phishing tool from Beijing contractor ITG on Oct. 8-9 and unsealed charges in Pennsylvania. Officials said the infrastructure is inoperable, though they could not confirm which of the 260,000 infected devices reached high-value networks.
Federal agents on Oct. 8–9 seized the hacking tools MicroScan and FishHub from Beijing-based contractor Integrity Technology Group (ITG), the FBI and Justice Department said, and unsealed criminal charges in the Western District of Pennsylvania against individuals tied to the company behind the Flax Typhoon campaign. The DOJ described the seized infrastructure as rendered inoperable, with continued monitoring planned.
The action targets the software pipeline that lets Flax Typhoon run its intrusions, not just a single command server—one of the more concrete blows yet against a campaign that has quietly exploited edge devices and small-office equipment for years.
What the tools did
MicroScan is a scanner that hunts for vulnerable—not merely present—devices on the internet, letting operators pick out targets running outdated or exposed software. It works by pivoting through a botnet of internet-of-things devices infected with Mirai malware, using them to probe for other weak targets. FishHub is the companion tool built on top of it: a spear-phishing service that delivers deceptive emails to gain remote access and download additional malware.
Together they form what the FBI described as ITG's malware-distribution apparatus. The government said the seized infrastructure had been actively used to compromise and control devices running Mirai Botnet malware—a weaponized botnet that turns weakly defended IoT and Windows devices into remotely controlled attack nodes.
Scale of the compromise
Justice Department accounting puts the toll at about 260,000 active compromised devices as of early June 2024, with roughly 126,000 infections in the United States. The campaign reached well beyond consumer gear: FBI officials said FishHub spear-phishing affected about 20 Taiwanese universities, and targets included Taiwanese natural gas and power companies, Japanese and Polish airports, and a US power company in South Carolina.
Attribution work by Microsoft, CISA, the NSA, and the UK's National Cyber Security Centre has tied the infrastructure to Flax Typhoon—also tracked as Ethereal Panda and Storm-0919—a China-based espionage actor that uses commercial contractors like ITG to conduct intrusions. ITG's specialty, investigators said, was using sanctions-evasion techniques to keep the operation running under US restrictions.
What was observed vs. what is confirmed
The disclosures distinguish between infection counts and confirmed intrusions into sensitive systems. The roughly 260,000 compromised devices are systems the botnet took control of—most of them consumer IoT gear with weak default credentials and unpatched firmware. That figure is not a count of breaches into critical infrastructure. Two victims in the Western District of Pennsylvania were named in the charges, and MicroScan's vantage point over exposed devices was cited as a specific enabler, but most exposed systems were not victims of data theft.
Nor does the seizure's cleanup effect extend to every version of the threat. The government said the campaign had already been disrupted once before, when a September 2024 court operation dismantled a Mirai botnet controlling more than 200,000 consumer devices. The current MicroScan access route ran through the domain c0cc.cc until Sept. 9, 2026—a week before this seizure—underscoring that the newest takedown targeted one known access path rather than the entire infrastructure.
The legal frame
Federal prosecutors unsealed charges against ITG and several individuals—including Zhang Yu, Xu Zewei, and others named in the action—for operating the hacking service and targeting US critical infrastructure. The indictment marks one of the first times the contractor itself, not just an attributed state sponsor, has been criminally charged in a US court for running the malware pipeline.
CISA, the FBI, and the NSA are expected to release technical advisories covering the seized tooling and the vulnerability classes MicroScan exploits.
What the seizure establishes
The action removes known infrastructure running the current iteration of the campaign, at least temporarily. What the seizure can't establish on its own is exactly which of the 260,000 device infections reached a high-value network, and whether any undetected clones of the service are still standing. Those two unknowns determine whether this is a decisive takedown or a costly speed bump for Flax Typhoon.
Comments ()