Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsOn October 8, 2026, the U.S. Department of Justice and FBI announced court-authorized seizures of domains supporting MicroScan and FishHub, tools authorities say were used by actors working for China-based Integrity Technology Group. The operation was intended to cut off access to those tools; it was not a shutdown of all Integrity Tech activity or evidence that every organization whose network was scanned was successfully breached.
What the coalition seized
The DOJ said it and the FBI obtained court-authorized seizures intended to deny malicious actors access to MicroScan and FishHub. The department described the actors as working for Integrity Technology Group (Integrity Tech), a China-based company it says has contracts with the PRC government. The warrant affidavit lists seven target domains, but the domains did not all serve the same function: the DOJ release identifies one used to access MicroScan and five that helped deliver malware associated with FishHub. The affidavit contains probable-cause allegations supporting the warrants, not a final finding of liability. DOJ announcement; warrant affidavit.
As an Amazon Associate I earn from qualifying purchases.
The DOJ called this its second public technical disruption of Integrity Tech infrastructure. The action followed a September 2024 disruption aimed at a Mirai malware botnet, a separate operation from the October 2026 domain seizures. In its 2026 account, the DOJ said that botnet involved more than 200,000 consumer devices in the United States and worldwide. DOJ announcement.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat MicroScan and FishHub did
MicroScan: vulnerability reconnaissance
The joint advisory says actors used MicroScan, a Python-based web application, as early as 2017. It contained more than 1,300 penetration-testing scripts for scanning websites for specific vulnerabilities. The DOJ says Integrity Tech developed it to conduct reconnaissance of victim networks, with clients later exploiting vulnerabilities. That description concerns the tool’s reported use in this activity, not a general endorsement or account of every use of the software. Joint advisory; DOJ announcement.
#1 Best Overall
FishHub: phishing and malware delivery
The DOJ says FishHub facilitated exploitation through spear-phishing. After an initial compromise, it could download additional malware that provided unauthorized remote access or searched for specific files and sent them to Integrity Tech-controlled servers. The department identified approximately 20 Taiwanese universities as confirmed FishHub victims. DOJ announcement.
How Integrity Tech and Flax Typhoon are connected
U.S. authorities associate Integrity Tech-enabled activity with Flax Typhoon. The joint advisory describes a wider range of behavior attributed to actors enabled by Integrity Tech, including scanning, cross-site scripting, password spraying against Microsoft Exchange, persistence through VPN software, and theft of emails and credentials. Those broader campaign techniques should not be confused with the specific functions DOJ attributed to MicroScan and FishHub.
The advisory also cautions that actors may operate beyond Integrity Tech’s support, and that labels used by external cybersecurity companies do not always align one-to-one with U.S. government attribution. Flax Typhoon is therefore useful context for the activity, but the label alone does not establish that every incident attributed to a similarly named group involved these tools or the same operators. Joint advisory.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Who was targeted—and what is confirmed
The DOJ and reporting identified MicroScan scanning of a South Carolina power company, a multinational nongovernmental organization, Japanese and Polish airports, Taiwanese natural-gas and power infrastructure companies, and two Taiwanese universities. A scan or target identification does not by itself establish a successful intrusion. Separately, DOJ described approximately 20 Taiwanese universities as confirmed FishHub victims; that figure should not be combined with the scanning examples to produce a campaign-wide victim total. The Record; DOJ announcement.
Rank #3
The Record’s account says Flax Typhoon activity has mainly targeted Taiwanese government and education organizations, critical manufacturing, and IT, with victims also observed in Southeast Asia, North America, and Africa. The joint advisory describes broader global activity. Neither source establishes a comprehensive total of victims for this operation. The Record; Joint advisory.
What organizational defenders should do
The joint advisory, dated October 8, 2026, urges network defenders to hunt for possible compromise and reduce exposure. Its actions are directed at organizations, not a consumer-device cleanup process. Use the advisory’s incident-response material and indicators of compromise with your security team; an indicator should be assessed in context rather than treated as proof on its own. Joint advisory and indicators.
Rank #4
- Patch promptly: Review exposed products and services against the advisory’s affected versions and apply vendor fixes.
- Reduce exposure: Disable services and ports the organization does not need, especially those exposed to the internet.
- Harden web applications: Sanitize input to prevent injection vulnerabilities.
- Strengthen identity controls: Apply identity, credential, and access-management policies and require multifactor authentication where possible.
- Hunt and respond: Check for potential compromise using the advisory’s guidance and indicators; escalate suspicious findings through the organization’s incident-response process.
The advisory lists eight CVEs observed in this activity: CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894. These are vulnerabilities associated with the reported campaign, not a new vulnerability disclosure. Consult the advisory appendix for affected products and versions; it also notes entries newly added to CISA’s Known Exploited Vulnerabilities catalog. Joint advisory.
What the seizure does—and does not—establish
The action targets domains supporting two tools, rather than all Integrity Tech infrastructure or all activity associated with Flax Typhoon. The DOJ said the FBI investigation was ongoing when it announced the seizures. The available official announcement and advisory do not establish the disruption’s long-term effect, a campaign-wide victim count, or a later case outcome. The joint advisory was authored by the FBI, CISA, NSA, the U.K. NCSC, Australia’s ACSC, Canada’s Centre for Cyber Security, Japan’s NPA and NCO, New Zealand’s NCSC, and Spain’s CNI. DOJ announcement; Joint advisory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
