Your incident response team just received the advisory: seven domains seized, Chinese state-sponsored tools disrupted, critical infrastructure targeted globally. Someone in the Slack channel asks, "So what changes for us on Monday?"
That's the question that matters. Here's what your team needs to know about the FBI's disruption of Flax Typhoon's MicroScan and FishHub platforms, and how to enhance your incident detection and response capabilities.
Understanding the Threat
The FBI seized seven domains linked to Integrity Technology Group, a Chinese contractor using vulnerability-scanning and spear-phishing platforms against critical infrastructure worldwide. The affidavit confirms breaches at Taiwanese universities, scanning of a South Carolina power company, and data theft from over 20 organizations. The joint advisory from the FBI, CISA, NSA, and international partners lists eight commonly exploited CVEs and detailed indicators of compromise.
Your team is reading the same advisory. These are the questions coming up in your meetings and incident channels.
Were We Scanned or Compromised?
Check the advisory's IOC list immediately. Look for specific domains like 98aicai.com and outlook3650.com, IP addresses tied to the scanning infrastructure, and file hashes associated with malware payloads.
Run SIEM queries against historical logs, not just current traffic. The affidavit mentions scanning activity dating back to August 2022, with breaches following months later. If you find MicroScan patterns in your logs from 2022 or 2023, don't assume the compromise didn't happen just because the domains are seized now.
Look for unauthorized SoftEther VPN installations. The attackers used 98aiblog.com to distribute this software for persistent remote access. Check endpoint detection logs for unexpected VPN client installations, especially on systems with access to sensitive data.
The custom email-browsing application mentioned in the FBI affidavit is particularly concerning. If breached, third parties may have accessed your email without touching your Exchange server directly. Review authentication logs for unusual access patterns to email accounts, especially administrative or executive mailboxes.
Why Do These CVEs Matter Now?
Because "most" isn't "all," and state-sponsored actors scan comprehensively. The advisory lists eight CVEs from 2014's Shellshock (CVE-2014-6278) to 2021's GitLab RCE (CVE-2021-22205). MicroScan contains over 1,300 penetration-testing scripts targeting widely deployed software.
Run vulnerability management reports for these eight CVEs across your entire environment, including development systems and legacy infrastructure. The Taiwanese universities were scanned and breached months later, suggesting attackers cataloged vulnerable systems and returned when convenient.
Pay attention to CVE-2019-11510, the Pulse Secure VPN vulnerability. Remote access infrastructure remains a primary target, and VPN appliances often sit outside standard patching cycles. If you're running Pulse Secure, Oracle WebLogic, Apache Struts, or Jenkins, verify patch status today.
The scanning activity used a botnet of Mirai-infected devices, meaning the traffic came from consumer IPs that your defenses might not flag as suspicious. Review vulnerability scan logs for unusual patterns from residential IP ranges.
Should We Be Worried If Our EDR Didn't Flag Anything?
Yes, but not because your EDR failed. The attackers used the EBurst tool for password-spraying against Exchange servers and custom tools for Active Directory credential theft. These techniques often generate authentication failures that look like user error, not malware activity.
Review authentication logs for failed login attempts, particularly against Exchange and Active Directory. Password-spraying generates low-volume failures across many accounts rather than high-volume failures against single accounts, which automated alerting often misses.
The FishHub malware gave attackers remote access and file search capabilities. If your EDR relies primarily on signature-based detection, it may not have flagged custom malware written specifically for this operation. Review network traffic logs for data exfiltration patterns: large file transfers to external IPs, especially during off-hours, or connections to the seized domains before the takedown.
The affidavit mentions investigators found data from over 20 organizations on a server linked to FishHub. If breached, your data might be on infrastructure you don't control. This isn't a scenario where you can remediate and move on; you need to understand what was taken.
What's the Risk from Contractor-Operated Threat Groups?
The operational risk is identical. Integrity Technology Group has contracts with the Chinese government, according to U.S. authorities. The distinction between "contractor" and "state actor" matters for attribution and sanctions, not for your defensive posture.
Contractors expand the attack surface. The FBI noted that China relies on contractors to extend the reach of their cyber operations. This means more infrastructure, more tooling, and more opportunities for law enforcement to disrupt operations, as demonstrated by this seizure and the September 2024 disruption of Integrity Tech's Mirai botnet.
For your team, this means you can't rely solely on threat intelligence tied to known state-sponsored groups. The advisory notes activity overlaps with Flax Typhoon, Ethereal Panda, and Red Juliett, but not all activity may be linked to Integrity Tech. Your detection strategies need to focus on techniques and behaviors, not just known actor profiles.
Beyond Multifactor Authentication
MFA stops password-spraying, but it doesn't stop exploitation of unpatched vulnerabilities. The attackers used both approaches. Review your MFA coverage for gaps: service accounts, administrative interfaces, legacy applications that can't support modern authentication.
Disable unnecessary exposed services, as the advisory recommends. MicroScan targeted 1,300+ potential vulnerabilities across widely deployed software. Every internet-facing service is a potential entry point. If you're running WordPress, Jenkins, or other development tools with external access, ask whether that exposure is operationally necessary.
The attackers maintained access using SoftEther VPN software. Review your application whitelisting and software installation policies. Can users or compromised accounts install VPN clients without approval? If so, you're giving attackers a straightforward persistence mechanism.
How Does International Cooperation Help?
The domain seizures directly degraded the attackers' operational capability. The FBI confirmed MicroScan was operational in September 2026; now those domains display seizure notices. That's infrastructure the attackers can't use against your network today.
The joint advisory from the FBI, CISA, NSA, and international partners provides specific IOCs and technical details you can use immediately. You're not waiting for a vendor report or threat intelligence subscription; you have government-validated indicators you can query against your logs right now.
The UK sanctioned Integrity Tech in 2025, and the EU sanctioned them in 2026. These actions constrain the organization's ability to operate openly, purchase infrastructure, and maintain business relationships. While sanctions don't stop cyber operations, they increase operational costs and complexity for the attackers.
For your organization, this means the threat intelligence you're receiving is backed by law enforcement investigation, not just commercial threat feeds. The affidavit details how investigators identified the tools, tracked the infrastructure, and confirmed the breaches. That level of detail helps you prioritize your response.
Next Steps
Download the full joint cybersecurity advisory from CISA's website. It contains the complete IOC list, technical details on MicroScan and FishHub, and specific mitigation recommendations. Run those IOCs against your logs today, not next week.
Review your vulnerability management program against the eight listed CVEs. If you find unpatched systems, prioritize them immediately. If you don't find any, verify your scanning coverage includes all network segments, including isolated or air-gapped systems that might have temporary internet connectivity.
Talk to your insurance broker about your Cyber Extortion Coverage and Data Restoration Coverage terms. If you discover a historical breach tied to this activity, you'll need to understand what your policy covers and what your Insurer Consent Requirement obligations are before you start remediation.
