The FBI and Justice Department announced court-authorized seizures on October 8, 2026, disrupting Flax Typhoon hacking tools used against critical infrastructure and other networks. The [Justice Department](https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated) said Microscan and FishHub supported scanning and, in some cases, intrusions in the United States and abroad.

Court documents allege that China-based Integrity Technology Group operated the tools. The department said the company has Chinese government contracts. The action follows a September 2024 disruption of its Mirai botnet, which comprised more than 200,000 consumer devices worldwide.

According to the department, Microscan used botnet infrastructure and other routes to search networks for weaknesses. Scanning targets included a South Carolina power company and airports in Japan and Poland. Being scanned does not itself establish that an organization was breached.

FishHub supported spear phishing and downloaded malware after an initial compromise, the department alleged. Payloads enabled remote access or located and transferred files to company-controlled servers. Officials identified approximately 20 Taiwanese universities as confirmed victims of FishHub activity.

The [Associated Press](https://apnews.com/article/8948c5d83180675bcf21cd98426eabf7) reported that officials said the operation had rendered the tools inoperable. FBI Cyber Division Deputy Assistant Director Jason Bilnoski described removing attackers' capabilities, including their infrastructure and tools, as the objective.

The Justice Department said an accompanying international advisory provides compromise indicators to help defenders identify and respond to related intrusions. Separately, FBI supervisory special agent Brett Lally told the Associated Press that investigators would monitor attempts by the company to rebuild its infrastructure.