In a significant escalation of the ongoing digital cold war, the United States Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have successfully dismantled a critical portion of the cyber-espionage infrastructure utilized by the China-based threat actor group known as "Flax Typhoon." The operation involved the seizure of seven strategic internet domains that served as the backbone for two sophisticated hacking toolsets: "Microscan" and "FishHub."

These tools were the primary mechanisms employed by Integrity Technology Group (Integrity Tech), a private firm operating out of China under contract with the Chinese government. By targeting these enablers, U.S. authorities aim to degrade the operational capacity of state-sponsored actors who have spent years systematically infiltrating critical infrastructure, academic institutions, and multinational organizations across the globe.

The Anatomy of the Operation: Microscan and FishHub

The investigation revealed that Integrity Tech acted as a force multiplier for Beijing’s cyber-espionage apparatus. By leveraging a sprawling botnet composed of compromised Internet-of-Things (IoT) devices—running on a variant of the notorious Mirai malware—the company developed a dual-pronged strategy for intelligence gathering and network intrusion.

Microscan: The Reconnaissance Engine

Microscan served as the group’s primary weapon for vulnerability research. The tool was designed to conduct automated reconnaissance across vast network segments, identifying weak points, unpatched software, and misconfigured services. Between April and December 2022, this tool was deployed with chilling precision. Targets included:

• A South Carolina power utility.
• A multinational non-governmental organization (NGO).
• Major international airports in Japan and Poland.
• Critical energy infrastructure in Taiwan, including power and natural gas providers.

By identifying these weaknesses, the hackers could stage their intrusions, often moving from initial scan to full network compromise within weeks.

FishHub: The Spear-Phishing Gateway

While Microscan focused on external reconnaissance, FishHub was designed for deeper, more intrusive engagement. As of March 2026, FishHub functioned as a sophisticated spear-phishing platform. Once a target was enticed into clicking a malicious link, FishHub facilitated the deployment of secondary payloads. These payloads provided Integrity Tech’s clients with either persistent remote access or a "vacuum" capability, capable of locating and exfiltrating sensitive intellectual property, emails, and credentials directly to servers controlled by the firm.

Chronology of Intrusion and Escalation

The timeline of Flax Typhoon’s activities illustrates a methodical, long-term approach to intelligence collection.

• 2022: The group begins aggressive scanning operations, utilizing Microscan to map the digital footprint of critical infrastructure in the U.S. and abroad.
• August 2022 – March 2023: Two Taiwanese universities are targeted. The scanning activity is followed almost immediately by successful network breaches, indicating a highly efficient "scan-and-exploit" workflow.
• September 2024: The U.S. government performs its first major disruption of Integrity Tech’s infrastructure, dismantling a massive botnet consisting of over 200,000 consumer-grade devices.
• March 2026: FBI intelligence identifies the ongoing use of FishHub. Investigations reveal that the same actors behind the 2024 botnet are continuing their operations, necessitating the current seizure of the seven domains.
• Present Day: The DOJ formally seizes domains including 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, and others, effectively neutralizing the command-and-control (C2) pathways for the group’s active malware.

Supporting Data: Infrastructure and Persistence

The complexity of the Flax Typhoon operation relied on a network of domains designed to appear innocuous. The seized domains served distinct functional roles:

1. Command and Control: The domain c0cc[.]cc was identified as the primary access point for Integrity Tech operators to manage their Microscan tool.
2. Delivery and Exfiltration: Domains such as youtubecard[.]com and linkedinns[.]net were used to mask malicious traffic, often masquerading as legitimate services to bypass simple security filters.
3. Persistence: The domain 98aiblog[.]com was utilized in conjunction with SoftEther VPN software. By installing this software on compromised networks—such as the universities in Taiwan—the attackers ensured they could maintain a "backdoor" into the network even if initial entry points were closed.

The DOJ’s affidavit, supported by FBI Special Agent Adam James, suggests that the nomenclature of these tools—specifically "FishHub"—was a deliberate nod to their primary function: facilitating phishing operations to hook unsuspecting victims.

Official Responses and Strategic Implications

The seizure is not merely a technical success; it is a profound diplomatic and strategic signal. By publicly identifying Integrity Tech as a government contractor, the United States is holding the People’s Republic of China (PRC) accountable for the "proxy" hackers it employs to bypass traditional diplomatic friction.

Brett Leatherman, Assistant Director of the FBI’s Cyber Division:

"The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure."

U.S. Attorney Troy Rivetti:

"These seizures, our second disruption of Integrity Tech’s massive operations in as many years, send another clear message to cybercriminals from the PRC and elsewhere of the Department’s dedication to defending and maintaining cybersecurity in the United States and abroad."

Assistant Attorney General John A. Eisenberg:

"The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace. The National Security Division will continue to respond decisively and use every tool at our disposal to dismantle the infrastructure sustaining these threats."

Defensive Mandates: What Organizations Must Do

In conjunction with the seizure, the FBI, CISA, and international partners have released a joint cybersecurity advisory. The advisory highlights that these actors are not using "zero-day" exploits exclusively; rather, they rely on a combination of automated scanning, password spraying, and basic misconfigurations.

To mitigate the risk posed by actors like Flax Typhoon, the agencies recommend the following measures:

• MFA Everywhere: Implementing Multi-Factor Authentication (MFA) is the single most effective defense against the credential-harvesting techniques used by FishHub.
• Sanitize Inputs: Organizations must rigorously sanitize web application inputs to prevent cross-site scripting (XSS) and SQL injection attacks, which are common precursors to deeper network penetration.
• Patch Management: The speed at which Flax Typhoon moves from reconnaissance to exploitation means that legacy "patch cycles" are no longer sufficient. Critical patches for Microsoft Exchange and VPN software must be applied as soon as they are available.
• Service Hardening: Disable all unused ports and services. Attackers cannot exploit a service that is not running, and limiting the attack surface is essential to preventing the lateral movement that characterized the university breaches.

The Broader Impact

The disruption of the Flax Typhoon infrastructure marks a turning point in how the United States manages state-sponsored cyber threats. Instead of merely hardening defenses, the government is moving toward an "offensive-defensive" posture, identifying the private contractors that provide the "picks and shovels" for state-sponsored hacking.

However, the resilience of these groups remains a concern. As evidenced by the transition from the 2024 botnet disruption to the 2026 tool seizure, these actors are persistent, well-funded, and adaptable. The dismantling of seven domains is a significant tactical victory, but it is unlikely to be the final chapter in the struggle to secure global networks against state-directed digital espionage. The challenge for organizations worldwide remains clear: the threat is not just a digital bug, but a human-led, enterprise-grade operation that requires constant vigilance and a fundamental change in how networks are architected and defended.