Jason Bilnoski, the FBI Cyber Division Deputy Assistant Director, called the hacking operation 'indiscriminate and reckless' as the FBI and Justice Department announced the seizure of two tools used by China-state-sponsored hackers on 8 October 2026.
The move is best read as an effort to remove the operation’s means of distribution and access, rather than simply disrupt individual infected devices. The FBI and Justice Department seized Microscan, a vulnerability-scanning tool, and FishHub, a spear-phishing tool, and officials said the latest operation had rendered them inoperable.
The FBI says the tools were operated by Integrity Technology Group, a Chinese-based information security company closely associated with the Chinese government and identified by the bureau as the group known in the private sector as Flax Typhoon.
Microscan was used to scan and target an unnamed U.S. power company, airports in Japan and Poland, universities in Taiwan, a multinational nongovernmental organisation and critical infrastructure companies in Taiwan.
FishHub supported phishing activity that gave hackers remote access to victims’ networks, enabling the theft of sensitive information.
The seizure follows an earlier intervention in September 2024, when the FBI disrupted a botnet associated with the same operation. Malicious software had been installed on more than 200,000 consumer devices, including cameras, video recorders, and home and office routers.
That botnet was used to facilitate cyber crimes, including the theft of sensitive information from victims’ networks.
The FBI believes the group has carried out disruptive cyber operations in the United States and abroad, including against the power industry, academia and critical infrastructure.
Brett Lally, an FBI San Diego Supervisory Special Agent, said the department would keep watching for ways Integrity Technology Group could rebuild its infrastructure.
Comments (0)