[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flAlaqkaEh5xBsQSWXLp1CGXGUNDM-BUvlXbkWfYM_bY":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"71effc66-2fe8-4b51-9b77-c60b16672280","DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub","doj-fbi-seize-flax-typhoon-linked-hacking-tools-microscan-fishhub-fbe764","The seizures of the tools, allegedly operated by the Chinese firm Integrity Tech, accompanied a warning from the FBI, CISA and NSA. The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop.","The US Department of Justice and FBI have seized two hacking tools, Microscan and FishHub, allegedly operated by the China-based company Integrity Technology Group and linked to the Chinese government-affiliated threat group Flax Typhoon. The seizure, accompanied by a joint advisory from the FBI, CISA, and NSA, aims to disrupt the group's operations which target organizations worldwide, including critical infrastructure. Integrity Technology Group has been previously sanctioned and targeted for its role in supporting these cyber activities.","US seizes hacking tools linked to China-backed Flax Typhoon and Integrity Tech.","https:\u002F\u002Fcyberscoop.com\u002Fdoj-fbi-seize-flax-typhoon-hacking-tools-microscan-fishhub\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-1493380206.jpg","2026-10-08T20:02:11+00:00","2026-10-08T22:00:21.995095+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Flax Typhoon","threat_actor",{"name":21,"type":22},"Integrity Technology Group","vendor",{"name":24,"type":25},"Microscan","product",{"name":27,"type":25},"FishHub",{"name":29,"type":22},"FBI",{"name":31,"type":22},"CISA","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,29,31],{"controls":58,"vendors":145},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":54,"name":89,"problem":90,"products":91},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":117,"name":118,"problem":119,"products":120},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":162},"state-sponsored-hacking-tools-seized-in-flax-typhoon-disruption-operation","State-Sponsored Hacking Tools Seized in Flax Typhoon Disruption Operation","The Flax Typhoon operation demonstrates how nation-state threat actors leverage purpose-built hacking tools — in this case Microscan and FishHub — to systematically compromise critical infrastructure worldwide over extended periods. The root issue lies in insufficient network monitoring and segmentation, which allowed these tools to operate undetected long enough to require a government-level seizure operation to disrupt them. This matters because critical infrastructure organizations are prime targets for geopolitical cyber espionage, and delayed detection dramatically increases the blast radius of any intrusion. The involvement of a sanctioned commercial company acting as a proxy for a government-affiliated threat group also underscores the blurring line between cybercrime and state-sponsored warfare.",[151,152,153,154,155,156,157,158,159,160,161],"CIS Control 7 - Continuous Vulnerability Management","CIS Control 13 - Network Monitoring and Defense","CIS Control 16 - Application Software Security","NIST SP 800-53 IR-4 - Incident Handling","NIST SP 800-53 SI-4 - Information System Monitoring","NIST SP 800-53 SC-7 - Boundary Protection","NIST Cybersecurity Framework DE.CM-1 - Network Monitoring","NIST Cybersecurity Framework RS.MI-1 - Incident Mitigation","MITRE ATT&CK - Flax Typhoon Group G1040","CISA Critical Infrastructure Security Advisory","Executive Order 14028 - Improving the Nation's Cybersecurity",{}]