On October 8, 2026, the U.S. Department of Justice and FBI announced a court-authorized operation targeting domains and two tools associated with activity attributed to Flax Typhoon: Microscan and FishHub. Court documents cited by the DOJ describe Microscan as a vulnerability-reconnaissance tool, while FishHub allegedly enabled spear-phishing intrusions. Attribution and case details are presented as allegations before the court.
Two tools for different stages
The DOJ describes Microscan as a reconnaissance tool developed by Integrity Technology Group. It scanned networks for vulnerabilities that clients could later exploit. Listed targets include a South Carolina electric company, an international non-governmental organization, airports in Japan and Poland, Taiwanese critical-infrastructure companies, and two Taiwanese universities.
FishHub allegedly supported the intrusion stage. After an initial spear-phishing compromise, it could download additional malware, provide unauthorized remote access, or search for selected files and send them to Integrity Tech-controlled servers. The DOJ identifies about twenty Taiwanese universities as confirmed victims of FishHub activity.
Seized domains do not remove local risks
The FBI and its partners obtained court-authorized seizures of seven domains associated with the tools or their infrastructure. The action is intended to stop operators from using those domains; it does not repair systems that may already have been compromised or confirm that all related activity has stopped.
BleepingComputer reports that the operation coincided with a joint advisory from the FBI, CISA, NSA, and international partners. The advisory describes targeted sectors and provides technical indicators for defenders. The same report says the activity overlaps with several tracking names, while agencies caution that not all activity is necessarily attributable to Integrity Tech.
What organizations can check
Administrators can compare official indicators with DNS, proxy, firewall, and authentication logs, then review unusual connections to exposed services. A scan attempt alone does not prove an intrusion. A match should prompt checks for vulnerable versions, affected accounts, and later movement across the network.
The DOJ documents describe automated scanning and spear-phishing techniques. Reduce exposure of administrative interfaces, apply available patches, and require strong authentication for remote accounts. After a suspicious email followed by an unusual login, revoke affected sessions and review mailbox rules and privileged accounts.
Keep the legal scope precise
The DOJ attributes Microscan and FishHub to Integrity Tech in the context of court documents and links some operations to Flax Typhoon. This describes allegations and evidence presented by authorities; it does not turn every attribution detail into an independent finding or final judgment.
Domain seizures are a technical disruption measure. The cited notices say multiple networks and sectors were targeted, but do not provide a complete inventory of affected systems or evidence that every target was compromised. Organizations should assess their own logs and official indicators instead of inferring exposure from the announcement alone.
How Soclyde relates
Soclyde does not detect Microscan scans or protect the targeted infrastructure. Its local-first encrypted vault helps people and small teams manage access passwords without a centralized cloud vault operated by Soclyde. Reducing service exposure, patching vulnerabilities, and responding to an intrusion remain separate responsibilities.
What to remember
U.S. authorities disrupted two tools and seized domains associated in court documents with activity attributed to Integrity Tech and Flax Typhoon. The tools covered both vulnerability reconnaissance and post-phishing exploitation; the operation does not replace log review or system remediation. See our NIS2 cybersecurity guide for a framework to strengthen your organization’s security practices.
