FBI Seizes Microscan and FishHub Tools Linked to China-Based Flax Typhoon Actors

The U.S. Department of Justice and the Federal Bureau of Investigation have seized two hacking tools, Microscan and FishHub, that were used by actors known as Flax Typhoon. According to court documents unsealed in the Western District of Pennsylvania, these tools were operated by personnel working for Integrity Technology Group, a company based in the People’s Republic of China.

Prosecutors allege that Integrity Tech holds contracts with the Chinese government and directed the use of these tools to scan and, in some cases, hack critical infrastructure systems in the United States and abroad. The seizure represents the latest enforcement action by U.S. authorities against state-sponsored cyber operations originating from China, targeting essential services and foreign networks.

Operational Methods and Botnet Infrastructure

According to the unsealed court filings, Integrity Technology Group developed Microscan specifically to perform reconnaissance on victim networks. The tool was designed to identify weaknesses and vulnerabilities that clients could later exploit. This systematic scanning allowed the actors to map out potential targets before launching more intrusive attacks against their infrastructure.

To support these vulnerability scanning efforts, the company built and utilized a botnet composed of internet-of-things devices. These devices were infected with a variant of Mirai malware, a well-known strain often used to compromise connected hardware. The botnet supported the company's vulnerability scanning through Microscan, enabling widespread reconnaissance across multiple targets.

Targets and Critical Infrastructure Impact

The primary targets of the Microscan scanning activities included U.S. and foreign critical infrastructure systems. The court documents indicate that the actors focused on networks that provide essential services. The scanning and subsequent hacking attempts aimed to gain footholds in these sensitive environments. The source material notes that targets of Microscan scanning included these critical sectors.

Integrity Technology Group is described in the filings as a PRC-based entity with direct ties to the Chinese government through its contracting relationships. This connection underscores the state-sponsored nature of the campaign, aligning with broader patterns of activity attributed to Flax Typhoon. The group’s actions reflect a coordinated effort to compromise industrial and utility sectors across multiple jurisdictions.

What should you do?

Security professionals should monitor for unusual network traffic patterns that may indicate reconnaissance activities from compromised IoT devices. Organizations managing critical infrastructure must ensure that all connected devices are properly secured and updated to prevent infection by malware variants like Mirai. Regular vulnerability assessments can help identify weaknesses before external actors exploit them, reducing the risk of unauthorized access to sensitive systems.

What to do and how to stay safe: Flax Typhoon

• Audit internet-facing IoT devices for signs of Mirai malware or other botnet infections.
• Review firewall logs for scanning activity consistent with vulnerability reconnaissance tools.
• Ensure critical infrastructure networks are segmented to limit lateral movement if breached.
• Monitor threat intelligence feeds for updates on Flax Typhoon tactics and indicators.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tools were seized in this operation?

The FBI seized Microscan and FishHub, hacking tools used by Flax Typhoon actors.

Which company operated these tools?

Integrity Technology Group, a China-based firm with government contracts, operated the tools.

What type of malware was used to support the scanning?

A variant of Mirai malware was used to infect IoT devices and form a botnet.