The U.S. Justice Department and FBI announced on October 8, 2026, that they had seized seven domains used by operators of Microscan and FishHub, two hacking tools associated with the activity tracked as Flax Typhoon. Federal officials say the tools supported attacks against critical infrastructure and other organizations. The allegations against the operators are drawn from court filings and government statements; the seizures are a documented law-enforcement action, not proof that the wider hacking campaign has ended.
What US authorities seized on October 8
The Department of Justice’s October 8 announcement describes court-authorized domain seizures designed to stop malicious actors from reaching important services that supported Microscan and FishHub. The Justice Department says the seized infrastructure included seven domains. A seized domain can disrupt a specific command or delivery channel, but actors may seek replacement infrastructure. It does not mean investigators have eliminated every compromised machine or recovered stolen data.
Microscan and FishHub served different purposes
Microscan was described as a vulnerability scanning capability used to identify exploitable targets across internet-facing systems. Such software can resemble legitimate assessment tools; the distinguishing factors are authorization and the subsequent use of the results. FishHub supported spear-phishing and malicious document delivery. According to the DOJ, attackers used delivered malware to gain unauthorized remote access to victim networks or locate and send specified files to infrastructure under their control. The release names five FishHub-associated delivery domains: 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com and linkedinns.net. These names are historical indicators cited for defensive awareness, not links that readers should visit.
Who the United States alleges was responsible
The U.S. alleges that cyber actors working for Integrity Technology Group, a company based in China, operated and used the two tools. Integrity Tech has contracts with Chinese government entities, according to the Justice Department, which linked the operation to activity commonly called Flax Typhoon. The attribution is a government allegation supported by the investigation and court documents, and should not be presented as an independently adjudicated finding of criminal responsibility. The DOJ says confirmed FishHub victims included roughly 20 universities in Taiwan. That figure describes identified victims in one reported category, not a complete global victim count. Cross-border targets underline why infrastructure seizure alone is a partial response.
How this differs from the 2024 Flax Typhoon disruption
The October 2026 seizures are separate from an earlier intervention in September 2024. In that earlier operation, U.S. authorities disrupted a Mirai-based botnet associated with Integrity Tech that included more than 200,000 consumer devices in the United States and elsewhere. Many online search results still describe that 2024 event, sometimes under headlines suggesting a recent Flax Typhoon takedown. Reusing those details as if they described this month’s seven-domain seizure would mislead readers. The newer action concerns named scanning and phishing tools, not a new seizure of 200,000 infected devices. The agency says it worked with national and international partners and separately issued a security advisory with indicators linked to the operation.
Implications for network defenders
Network defenders can review the official cybersecurity advisory and compare its indicators with authorized internal telemetry, rather than relying only on high-level reporting or trying to access suspicious domains. Logs for authentication failures, unusual outbound connections, unsolicited attachments and suspicious remote-access sessions can help establish whether further investigation is warranted. Organizations should follow their existing incident-response process when they find credible matches and avoid treating a domain match by itself as conclusive attribution. The broader lesson from this case is that state-linked intrusion ecosystems can combine scanning, social engineering, malicious delivery infrastructure and compromised endpoints. Disrupting one layer imposes costs on attackers, but defensive monitoring and patching remain necessary.
