The short answer
A takedown removes the tools, not the exposure they found. On October 8, 2026, the US Justice Department and FBI announced court-authorized seizures of domains used to run Microscan, a vulnerability scanner, and FishHub, a spear-phishing and malware platform. Officials say both were built and operated by Integrity Technology Group, a Beijing-based company with Chinese government contracts that the security industry tracks as Flax Typhoon.
Named targets include a South Carolina power company, airports in Japan and Poland, Taiwanese gas and power companies and about 20 Taiwanese universities. The same day, CISA added five old flaws in ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE Docs and Strapi to its Known Exploited Vulnerabilities catalog. If your estate still runs legacy components that nobody has upgraded in years, this is the kind of campaign that finds them first.
What did the FBI seize, and from whom?
According to the Justice Department, Microscan ran reconnaissance against victim networks to identify vulnerabilities that could then be exploited, using a botnet of internet-connected devices infected with a Mirai variant. FishHub took over once a target was hooked by a phishing email: it delivered additional malware that gave the operators remote access and the ability to search for and pull files. The Record reports that Microscan had been in use since 2017.
FBI officials described the activity as “indiscriminate and reckless” and said the aim of the operation was to remove the capability from the operators, the Associated Press reported. The accompanying multinational advisory also documents an email-theft operation against government, law enforcement, healthcare and religious organizations, and a tool used to break into Microsoft Exchange through password attacks. This is the second disruption of Integrity Tech infrastructure in about two years.
Why are decade-old vulnerabilities still the entry point?
The flaws CISA added to its exploited list on October 8 are not new. The ProFTPD and BIND bugs date from 2015, the Apache Struts issue from 2016, the ONLYOFFICE flaw from 2021 and the Strapi flaw from 2023. Fixes for all of them have been available for years. BleepingComputer, which reviewed the court documents, lists them among the CVEs Flax Typhoon targeted most often, alongside older bugs in Bash and Pulse Secure VPN and a GitLab flaw from 2021.
That pattern is common in large scanning campaigns. Automated scanners are cheap, and the payoff comes from the long tail: a forgotten FTP server, an internal DNS box exposed by a firewall change, a Struts app nobody owns anymore, a self-hosted CMS deployed for a marketing campaign and never updated. None of those requires a zero-day.
What it means for US & EU software teams
First, your attack surface includes everything a vendor or an old project left behind. Most organizations know their main application stack. Fewer can say, within an hour, which versions of FTP, DNS, document servers and headless CMS instances are reachable from the internet. Microscan-style tools answer that question for attackers continuously.
Second, regulators already treat unpatched known flaws as a governance failure. In the EU, NIS2 and DORA expect documented vulnerability handling and timely patching for in-scope entities, and an incident that starts with a 2015 CVE is hard to defend in a post-incident review. In the US, CISA’s KEV catalog is binding only on federal civilian agencies, but enterprise customers and cyber insurers increasingly use it as the yardstick in security questionnaires.
Third, phishing remains the second half of the chain. FishHub turned a successful phishing email into persistent access. Scanning finds the weak server; phishing finds the person with access to everything else. Defenses need to cover both, which means patching and phishing-resistant MFA, not one or the other.
What should teams check this week?
- Search for the five KEV entries. Look for ProFTPD (CVE-2015-3306), ISC BIND (CVE-2015-5477), Apache Struts with Dynamic Method Invocation enabled (CVE-2016-3081), ONLYOFFICE Docs (CVE-2021-3199) and Strapi (CVE-2023-22894) across production, staging and forgotten hosts.
- Build an external asset inventory. List every public IP, hostname and exposed service with its software version. Include vendor-hosted systems and old campaign sites.
- Retire what you cannot patch. If a component is out of support, isolate it behind a VPN or remove it. An unpatched service with no owner is the ideal target for automated scanning.
- Enforce MFA everywhere, including Exchange and VPN. The advisory describes password attacks against Microsoft Exchange; phishing-resistant MFA blunts both password spraying and phished credentials.
- Check the indicators. Review the joint advisory’s indicators of compromise and look for traffic to the seized domains in DNS and proxy logs.
Frequently asked questions
What did the FBI seize from Flax Typhoon?
On October 8, 2026, the Justice Department and FBI announced court-authorized seizures of domains used to run Microscan, a vulnerability-scanning tool, and FishHub, a spear-phishing and malware platform. The FBI says seven domains were seized. Officials say both tools were built and operated by Integrity Technology Group, a China-based company with government contracts linked to Flax Typhoon.
Who was targeted by Microscan and FishHub?
Targets named by US authorities include a South Carolina power company, airports in Japan and Poland, a multinational NGO, Taiwanese natural gas and power companies, and about 20 Taiwanese universities that were victims of FishHub.
Which vulnerabilities should we patch first?
Start with the five flaws CISA added to its Known Exploited Vulnerabilities catalog on October 8, 2026: ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. Then check older Bash, Pulse Secure VPN and GitLab flaws that Flax Typhoon also targeted.
Does the domain seizure make us safe?
No. The seizure disrupts one operator’s tools, but the vulnerable systems those tools found are still vulnerable until they are patched, isolated or retired. Other groups run similar scanners against the same well-known flaws.
Is the CISA KEV catalog mandatory for private companies?
Binding deadlines apply only to US federal civilian agencies. Private companies are not legally bound by KEV, but enterprise customers, auditors and cyber insurers widely use it to judge patching discipline, and EU rules such as NIS2 and DORA require documented vulnerability handling for in-scope entities.
Sources
US Department of Justice — Justice Department and FBI seize vulnerability scanning and spear phishing tools operated and used by China state-sponsored hackers
Associated Press (via Fortune) — FBI says it seized phishing tools used by Chinese hackers in ‘indiscriminate and reckless’ cyber operation
The Record — International coalition seizes tools used by cyber firm behind Flax Typhoon
BleepingComputer — FBI disrupts Chinese hacking tools used to breach critical infrastructure