Executive Summary
On October 8, 2026, the Department of Justice and FBI announced the seizure of seven domains supporting cyber operations attributed to Flax Typhoon, the Chinese state-linked group Microsoft first named publicly in August 2023. The seized domains — 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, c0cc.cc, and 98aiblog.com — supported two distinct tools: MicroScan, a Python-based reconnaissance and vulnerability-scanning tool built on more than 1,300 penetration-testing scripts targeting platforms including WordPress, Jenkins, Oracle WebLogic, and Apache Struts; and FishHub, a spear-phishing malware delivery platform. The action was accompanied by a joint advisory, tracked as CISA AA26-281A, co-published with the UK, Australia, Canada, Japan, New Zealand, and Spain. FBI officials involved in the case, Jason Bilnoski and Brett Lally, were both quoted characterizing this as disruption rather than an endpoint — they expect the group to rebuild its infrastructure.
What the Seized Tools Did
MicroScan’s scale is the headline detail: over 1,300 bundled scripts aimed at identifying exploitable flaws in widely deployed platforms, consistent with the group’s documented pattern of exploiting internet-facing applications as an initial foothold before moving to quieter, living-off-the-land techniques. FishHub’s role was spear-phishing malware delivery — the mechanism that, per court documents cited in the DOJ announcement, directly led to confirmed breaches at roughly 20 Taiwanese universities. Separately, court documents also confirm that two Taiwanese universities were breached following MicroScan-driven scanning activity, distinguishing scan-to-breach incidents from the phishing-driven ones.
Who’s Behind It
US authorities identify Flax Typhoon’s “true identity” as Integrity Technology Group, a Beijing-based company — also known as Yongxin Zhicheng, listed on a Shanghai exchange with a market capitalization of roughly $318 million and about 500 employees — founded in 2010 by Cai Jingjing. The FBI and DOJ tie the company to China’s Ministry of State Security. This isn’t a new accusation: Treasury’s OFAC sanctioned Integrity Technology Group on January 3, 2025, freezing its US assets and restricting its dealings with US financial institutions. The October 2026 domain seizure is a separate, follow-on disruption action against the same identified operator, not a new attribution.
Background: How Flax Typhoon Operates
Microsoft’s original 2023 naming described a pattern built around living off the land rather than custom malware: exploiting public-facing VPN, web, Java, or SQL servers, dropping the China Chopper web shell, using WMIC and PowerShell for follow-on access, abusing the Windows Sticky Keys feature for persistence, and then installing SoftEther VPN — renamed to mimic legitimate Windows processes like conhost.exe or dllhost.exe — to maintain a persistent tunnel into the victim network. From there, Mimikatz and SAM database dumping support pass-the-hash lateral movement, with some reporting also noting use of Juicy Potato and BadPotato for privilege escalation. Microsoft assessed the group with high confidence as PRC-based and noted overlap with CrowdStrike’s “Ethereal Panda” tracking. FortiGuard separately lists Storm-0919 and UNC5007 as aliases. Recorded Future has also proposed that its own-tracked “RedJuliett” cluster closely overlaps with Flax Typhoon/Ethereal Panda — an overlap Recorded Future itself asserts, not one independently confirmed by Microsoft.
The group is also linked to the Raptor Train botnet, documented by Lumen’s Black Lotus Labs: a Mirai-variant payload called Nosedive running across tiered SOHO and IoT device infrastructure, with estimates ranging from 200,000 to roughly 260,000 compromised devices total and a peak of around 60,000 concurrently active. Active since approximately May 2020, the botnet showed no observed DDoS activity — consistent with use as reconnaissance or traffic-relay infrastructure rather than a disruption tool. It’s worth noting the term “operational relay box,” commonly used to describe this style of botnet-as-infrastructure, did not turn up in any source checked specifically describing Raptor Train — the botnet is the best-documented match for that kind of infrastructure, but the ORB label itself isn’t confirmed as applied to it. The FBI disrupted Raptor Train in a September 2024 court-authorized operation; then-FBI Director Christopher Wray stated roughly half of the hijacked devices were US-based.
Victims
Beyond the Taiwanese university breaches confirmed in court documents, the DOJ’s October 2026 announcement names a South Carolina power company, airports in Japan and Poland, and Taiwanese natural gas and electricity providers among confirmed targets. Historically, Microsoft’s 2021–2023 tracking showed the group concentrated on Taiwanese government, education, and critical manufacturing organizations, the IT sector broadly, and some targets in Southeast Asia, North America, and Africa.
What’s Unconfirmed
Secondary reporting around this action references “eight CVEs since 2014” associated with the group’s exploitation history and a prior joint advisory numbered AA26-113A from April 2026. Neither claim could be independently verified against a primary CISA source in the course of this reporting, and both should be treated as unconfirmed pending direct verification against cisa.gov.
What This Means
Domain seizures disrupt operational tempo, not capability — the FBI’s own officials said as much on the record. MicroScan’s scanning-at-scale approach against common platforms like WordPress, Jenkins, and WebLogic is a reminder that unpatched, internet-facing instances of mainstream software remain this group’s preferred way in, ahead of anything more exotic. Organizations running any of the platforms MicroScan targets, particularly in the sectors named in this action — energy, transportation, education, and government — should treat this disruption as a prompt to check exposure now, on the expectation that the underlying operation resumes under new infrastructure.