Seven domains seized, one stolen-mail portal unaccounted for

Two documents, one day

On 8 October 2026 the FBI, CISA and the NSA published a joint advisory, AA26-281A, with the United Kingdom’s NCSC, Australia’s ASD, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s NCSC and Spain’s CNI ^[1]. It describes Chinese government-linked actors enabled by Integrity Technology Group, a China-based for-profit company with government links that the advisory says acquires or builds tooling, acquires and hosts infrastructure, and compromises victim networks itself ^[1]. The agencies state the tradecraft is consistent with activity publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett, while noting those actors may also conduct activity unrelated to the company ^[1].

The same day, the Department of Justice announced court-authorised seizures of seven domains used to deny access to two intrusion tools, named in the unsealed documents as Microscan and FishHub, with the affidavit and seizure warrant filed in the Western District of Pennsylvania ^[2]. The department described it as its second public technical disruption of the company’s infrastructure, after the September 2024 operation against a Mirai-variant botnet of more than 200,000 consumer devices ^[2][4]. The 2024 joint advisory recorded that botnet at over 260,000 devices as of June 2024 ^[5]. The company was sanctioned by the United States Treasury on 3 January 2025 ^[3].

Read together, the two documents describe a supplier, not a group. That distinction is the substance of the disclosure.

What was seized, and what was not

The seizures are specific about function. One domain provided access to Microscan, the reconnaissance and vulnerability scanning platform. Five delivered malware following an initial compromise through FishHub, the spear-phishing tool. The seventh was tied to unauthorised remote administration software used to connect several victim networks back to a company server ^[2][11].

The advisory treats collection separately. It describes a custom web application that gave unidentified third parties access to stolen mail, queried by placing account identifiers in a URL, with access in some incidents limited to addresses in Xiamen ^[1][10]. It describes a PHP bot that collected mail, calendar and contact data through the Exchange Web Services interface, compressed and sometimes encrypted it, and uploaded it to remote servers; and a command-line utility that automated access to Microsoft 365 mailboxes using stored configuration values ^[1][9]. The advisory does not say that any of this collection infrastructure has been disrupted, and the Justice Department release does not claim it ^[1][2].

That is the operationally important reading of 8 October. A disruption occurred, and it was real, but it addressed the front of the pipeline. An organisation whose mail was taken before the seizures has no basis in either document for assuming that the copies are no longer queryable, or that the third parties who could query them have lost access.

Old vulnerabilities, automated at scale

Nothing in the access set is novel. The advisory lists eight successfully exploited vulnerabilities, and five of them were added to the Known Exploited Vulnerabilities catalog alongside its publication, with a remediation date of 11 October 2026 for United States federal agencies: flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND, carrying identifiers from 2015, 2021, 2023, 2016 and 2015 respectively ^[6]. The other three were already catalogued, the oldest dating from 2014 ^[6][8]. No zero-day exploitation is described ^[1].

The scale comes from tooling rather than from exploits. Open-source scanners are used to find vulnerable hosts and applications, concentrated on six ports: 21, 22, 53, 80, 443 and 1080 ^[1][7]. Microscan is described as a Python web application carrying more than 1,300 penetration-testing scripts, in use since at least 2017, aimed at flaws in products including Oracle WebLogic, WordPress and Jenkins ^[1][11].

For mail specifically, a password-spraying tool cycles through roughly ten Exchange authentication interfaces, including Exchange Web Services, Outlook Web App, the Exchange Control Panel, Autodiscover and ActiveSync ^[1][9]. Persistence is maintained with SoftEther VPN clients installed on victim systems, in observed cases renamed to resemble legitimate Windows binaries, and credential access includes a directory replication tool that pulls Active Directory data including credentials, group memberships and trust relationships ^[1][8]. Access to victim networks dates to at least mid-January 2021 ^[1].

The Asia-Pacific record

The advisory’s own victim summary is regional and general: United States critical infrastructure across government services and facilities, critical manufacturing, healthcare and information technology, plus law enforcement, education and religious organisations, with victims also identified in South-East Asia, Africa and North America, and confirmed mailbox theft against government, law enforcement, healthcare and religious organisations in South-East Asia ^[1][10].

The seizure documents are more specific, and they name different places. Microscan scanning targets included a power company in South Carolina, a multinational non-governmental organisation, airports in Japan and Poland, natural gas and power companies in Taiwan, and two Taiwanese universities. FishHub victims confirmed in the documents number approximately 20 Taiwanese universities ^[2][11]. Treasury’s 2025 sanctions notice had already recorded a particular focus on Taiwan in the group’s operations ^{[3] [5]}.

The two victim pictures do not contradict each other, but they are not the same picture, and the regional one is the less precise of the two. Practitioners in the region should read the court documents rather than the advisory summary for the specific question of who was touched. Note also that scanning is not compromise: the documents distinguish scanned targets from confirmed victims, and that distinction should survive into any internal briefing built from them ^[2][11].

Where defender leverage actually sits

The advisory undercuts the usual first response to a disclosure of this kind. It states that several of the published indicators date to as early as 2016, and advises that they be vetted before blocking ^[1]. Ten addresses in the current indicator set also appeared in the 2024 advisory ^[10]. An indicator set spanning a decade of a supplier’s infrastructure is useful for retrospective hunting and poor for prevention.

The controls that bite are elsewhere, and the advisory names them: multifactor authentication, specifically for webmail, VPN access and critical systems; reduction of internet exposure and of the information disclosed by login pages and banners; input sanitisation on web applications; replacement of default credentials, least privilege and review of administrative accounts; patching and replacement of end-of-life products; and network segmentation with connectivity limited to what each device needs ^[1]. On detection, the advisory directs attention to scanning activity, unexpected Active Directory replication, misuse of native tooling, high outbound or upload volumes from workstations, abnormal logons outside working hours or from implausible locations, and connected cloud applications holding access to mail and files ^[1].

Two refinements are worth adding from the practitioner commentary on the advisory. Instrument every Exchange authentication interface rather than only interactive webmail, because a spray across ten paths is invisible to monitoring that watches one ^[8][9]. And treat directory replication initiated from anything other than a domain controller as a high-value detection in its own right ^[8]. During recovery, revoke sessions and tokens and rotate application secrets rather than only resetting passwords, since the Microsoft 365 collection utility works from stored configuration values rather than interactive logons ^[9].

The cyber operations reading

The pattern on display is procurement. A contractor builds scanning, phishing, persistence and collection capability, operates it against targets of state interest, and exposes the product of collection through an interface that other parties can query. Disrupting that arrangement means disrupting a business, and a business can be disrupted at several points, of which domain seizure is the most visible and the least durable. This is the second seizure against the same company in two years ^[2]. The capability it supports has run since at least 2021 against vulnerabilities published as long ago as 2014 ^[1][6]. For defenders in the region the implication is unglamorous and firm: the ceiling on this operator is set by unpatched internet-facing software and by mail interfaces without enforced multifactor authentication, and those are both local decisions rather than matters for a court in Pennsylvania.