On October 8, 2026, the FBI took action against Flax Typhoon, a China-linked intrusion group, seizing seven domains used to run two hacking tools—MicroScan, a vulnerability scanner, and FishHub, a spear-phishing and malware delivery platform—allegedly operated by China-based Integrity Technology Group under contract to the Chinese government. The Justice Department’s seizure was coordinated with a joint CISA, FBI, and NSA advisory joined by international partners, which named eight commonly targeted vulnerabilities including the five that would be cataloged two days later.
A day later, on October 9, CISA added five security flaws—CVE-2015-3306 in ProFTPD, CVE-2021-3199 in ONLYOFFICE, CVE-2023-22894 in Strapi, CVE-2016-3081 in Apache Struts, and CVE-2015-5477 in ISC BIND—to its Known Exploited Vulnerabilities catalog after abuse by China-linked Flax Typhoon, with federal agencies required to patch or discontinue use by October 11, 2026. The additions coincided with a joint advisory issued by Australia, Canada, Japan, New Zealand, Spain, the United Kingdom, and the United States warning of attacks enabled by China-based Integrity Technology Group.
The compressed timeline between cataloging and the federal patch deadline—two days—reflects how actively the five vulnerabilities were being exploited in the wild. Among the five are flaws first disclosed in 2015 and 2016, yet their presence in a 2026 campaign shows how long-lived unpatched software remains a viable entry point for state-linked contractors.
MicroScan and FishHub illustrate the operational shape of the campaign. A scanner that maps vulnerable surfaces paired with a delivery platform for targeted phishing is a standard but effective combination, and the domain seizures suggest the infrastructure had a centralized choke point that made disruption feasible without a full takedown of the group.
What stands out is the alignment of law enforcement and vulnerability-management actions across borders. In the same week the FBI cut off domains, allied governments published warnings attributing the enabling infrastructure to a specific China-based company, and CISA forced a near-immediate remediation clock for federal agencies.
Whether the seizures meaningfully degrade Flax Typhoon’s capacity remains to be seen; domain takeovers are reversible, and contractors can stand up replacement infrastructure. But the public naming of Integrity Technology Group and the tight patch deadline together raise the cost of continuing the documented pattern of behavior.