DOJ & FBI Seize Hacking Tools Linked to China's Flax Typhoon
US Seizes Hacking Tools Used by China-Linked Group Flax Typhoon
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
On October 8, 2026, the U.S. Department of Justice (DOJ) and the FBI announced a court-authorized operation to seize and disrupt hacking infrastructure used by the Chinese state-sponsored threat actor Flax Typhoon (also known as Ethereal Panda). The operation dismantled two custom hacking tools, Microscan and FishHub, by seizing seven domains used for their command and control. These tools were developed by Integrity Technology Group, a Chinese company previously sanctioned by the U.S. for supporting state-sponsored hacking operations. The campaign targeted a wide array of victims globally, including critical infrastructure in the U.S., airports in Japan and Poland, and numerous government and university targets in Taiwan. The disruption was accompanied by a joint advisory and the addition of five CVEs exploited by the group to CISA's KEV catalog.
Threat Overview
Flax Typhoon is a sophisticated threat actor linked to the People's Republic of China, focusing on intelligence gathering and initial access operations. This campaign demonstrates their use of a multi-stage attack methodology, leveraging custom-built tools for reconnaissance and initial compromise.
Microscan: This tool was used for large-scale vulnerability scanning to identify potential targets. It was operated via a botnet of Mirai-infected IoT devices, allowing the actor to obfuscate the origin of their scanning activity. Targets included a power company in South Carolina and critical infrastructure operators in allied nations.FishHub: This was a dedicated spearphishing platform used to deliver malicious payloads and gain initial access to targeted networks. It was successfully used against at least 20 universities in Taiwan.
Once initial access was gained, the threat actor was observed deploying SoftEther VPN software to establish persistent remote access, enabling long-term espionage and data theft.
Technical Analysis
The operation showcases a clear and structured attack chain employed by a nation-state actor.
Tactics, Techniques, and Procedures (TTPs)
- Reconnaissance: Flax Typhoon used the
Microscantool, powered by a Mirai botnet, to conduct widespread vulnerability scanning against critical sectors.T1595.002 - Vulnerability Scanning. - Resource Development: The group developed and operated custom tools (
Microscan,FishHub) and acquired infrastructure (domains, botnet) to support their campaigns.T1587 - Develop CapabilitiesandT1583 - Acquire Infrastructure. - Initial Access: The
FishHubplatform was used to conduct targeted spearphishing campaigns.T1566.001 - Spearphishing Attachment. The group also exploited at least five known vulnerabilities, now added to the CISA KEV catalog. - Persistence: The actor deployed
SoftEther VPNon compromised systems to maintain long-term, encrypted access to victim networks.T1133 - External Remote Services.
Impact Assessment
The primary impact of Flax Typhoon's activity is espionage and intelligence gathering against strategic targets in the U.S. and its allies, particularly Taiwan. By compromising critical infrastructure, government agencies, and universities, the actor gains access to sensitive political, economic, and military information. While this campaign did not appear to involve disruptive or destructive payloads, the persistent access it established creates the potential for future disruptive attacks during a time of crisis. The seizure operation by the DOJ and FBI serves to degrade the actor's capabilities and publicly attribute the activity, raising the cost of their operations.
IOCs — Directly from Articles
While the articles mention the seizure of seven domains, the specific domain names were not listed.
Cyber Observables — Hunting Hints
Security teams can hunt for signs of Flax Typhoon activity using the following observables:
process_namesoftether_vpn.exenetwork_traffic_patternMicroscan botnet.file_nameMicroscan.exe, FishHub.exelog_sourceSoftEther VPN connections, especially those originating from endpoints and connecting to external IPs.Detection & Response
- Threat Intelligence Integration: Ingest the CVEs and any available IOCs from the CISA advisory into your vulnerability management and security monitoring tools. Prioritize patching the five KEV CVEs.
- Network Monitoring: Monitor for traffic associated with
SoftEther VPNor other unauthorized remote access tools. D3FEND Outbound Traffic Filtering can block connections to known malicious domains. - Email Security: Enhance email security gateways to detect and block spearphishing attempts. Analyze emails for lures related to topics of interest to the targeted institutions.
Mitigation
- Patch Management: Immediately patch the five vulnerabilities exploited by Flax Typhoon that were added to the CISA KEV catalog. This is the most effective way to prevent initial access via this vector. This aligns with D3FEND Software Update.
- Application Control: Use application control solutions to prevent the execution of unauthorized software, such as
SoftEther VPN. This is an implementation of D3FEND Executable Allowlisting. - Reduce Attack Surface: Disable or restrict access to services and ports that are not essential for business operations to limit the effectiveness of the
Microscanvulnerability scanner.
Timeline of Events
Article Updates
October 13, 2026
Allied nations join US in warning about China's Integrity Tech, expanding target scope to North America, SE Asia, Africa, and detailing new LotL TTPs.
MITRE ATT&CK Mitigations
Update Software
Patch the five specific CVEs added to the KEV catalog that are known to be exploited by Flax Typhoon.
Filter Network Traffic
Block traffic to and from the domains and IPs identified in the joint advisory to disrupt C2 communications.
Execution Prevention
Use application control to block the execution of unauthorized remote access software like SoftEther VPN.
User Training
Educate users to recognize and report spearphishing attempts from the FishHub platform.
D3FEND Defensive Countermeasures
Flax Typhoon relies on exploiting known vulnerabilities for initial access. CISA has explicitly added five CVEs used by this actor to the KEV catalog. The most direct and effective countermeasure is to immediately prioritize patching these specific vulnerabilities across the enterprise. Organizations should use their vulnerability management systems to identify all affected assets and deploy the relevant vendor patches. Given the federal mandate to patch by October 11, 2026, all organizations should treat this with similar urgency. This action directly removes the initial access pathways exploited by the threat actor's Microscan tool, hardening the environment against their reconnaissance and exploitation efforts.
To counter Flax Typhoon's use of SoftEther VPN for persistence, organizations should implement application control policies. A denylisting (or blocklisting) approach is highly effective here. Use an EDR or application control solution like AppLocker to create rules that prevent the execution of softether_vpn.exe, vpnclient.exe, and other related binaries associated with SoftEther VPN on all endpoints and servers where it is not an approved corporate tool. This should be enforced across the environment, especially on servers, as they are high-value targets for persistence. This D3FEND technique disrupts the actor's ability to maintain long-term access, forcing them to find other methods and increasing the likelihood of detection.
Timeline of Events
The US Department of Justice and FBI announce the seizure of tools and domains used by Flax Typhoon.
Deadline for US federal agencies to patch five CVEs exploited by Flax Typhoon, as mandated by CISA.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.