Nation-State high China (PRC)

Flax Typhoon

US FBI/DOJ identify the group's true identity as Integrity Technology Group (Beijing, aka Yongxin Zhicheng), tied to China's Ministry of State Security; OFAC-sanctioned January 3, 2025. Microsoft assesses PRC-based with high confidence. · Espionage / access pre-positioning

Reports 1

Active Since At least mid-2021

Last Reported 16 Oct 2026

Sectors Targeted energy, government, education, transportation, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

Exploits public-facing VPN/web/Java/SQL servers; drops China Chopper web shell; WMIC/PowerShell follow-on
Abuses Sticky Keys for persistence; installs renamed SoftEther VPN (mimicking conhost.exe/dllhost.exe) for a persistent tunnel
Mimikatz/SAM dumping for pass-the-hash; Juicy Potato/BadPotato for privilege escalation
MicroScan: Python recon tool, 1,300+ scripts targeting WordPress/Jenkins/Oracle WebLogic/Apache Struts
FishHub: spear-phishing malware delivery platform
Raptor Train botnet: Mirai-variant 'Nosedive' payload across 200,000+ SOHO/IoT devices; no DDoS observed, consistent with recon/relay use

Known Targets

~20 Taiwanese universities (FishHub), 2 Taiwanese universities (MicroScan scanning)South Carolina power company; airports in Japan and Poland; Taiwanese gas/electricity providersHistorically: Taiwan government, education, critical manufacturing, IT sector

Analyst Notes

October 8, 2026: DOJ/FBI seized seven domains supporting MicroScan and FishHub infrastructure, alongside a joint advisory (CISA AA26-281A) with UK/Australia/Canada/Japan/New Zealand/Spain. FBI officials expect the group to rebuild. Raptor Train botnet separately disrupted via a September 2024 FBI operation. Claims of '8 CVEs since 2014' and a prior 'AA26-113A' advisory are unverified against a primary CISA source.

Also Known As

Storm-0919, UNC5007 (FortiGuard)Ethereal Panda (CrowdStrike)Possible overlap with Recorded Future's 'RedJuliett' (asserted by Recorded Future, not independently confirmed by Microsoft)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1505.003 Server Software Component: Web Shell T1059 Command and Scripting Interpreter T1546.008 Event Triggered Execution: Accessibility Features T1572 Protocol Tunneling T1003.001 OS Credential Dumping: LSASS Memory

Intelligence Reports

Briefing energygovernment

DOJ Seizes Seven Domains Tied to Flax Typhoon's Recon and Phishing Tools

The FBI took down infrastructure behind MicroScan and FishHub, two tools used by the Chinese state-linked group the US says operates as Integrity Technology Group. Officials expect the group to rebuild — this is disruption, not dismantlement.

16 Oct 2026 · 6 min read