kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

Flax Typhoon

also tracked as integrity technology group 1

3 stories · 3 in the wild · October 9, 2026 – October 11, 2026

evidence: 3 observed

sectors

  • education 2 · Oct 11
  • government 2 · Oct 11
  • energy 1 · Oct 9
  • telecom 1 · Oct 9
  • transport 1 · Oct 9

geography

  • taiwan 2 · Oct 11
  • united states 2 · Oct 11
  • china 1 · Oct 9
  • japan 1 · Oct 9
  • poland 1 · Oct 9

malware and tools

  • fishhub 2 · Oct 11
  • microscan 2 · Oct 11
  • sparrow 1 · Oct 11
  • mirai 1 · Oct 9

techniques

  • credential stuffing 1 · Oct 9
  • exfiltration 1 · Oct 9
  • persistence 1 · Oct 9
  • vulnerability scanning 1 · Oct 9

attack phases seen

  • Credential access 1 · Oct 9
  • Exfiltration 1 · Oct 9
  • Initial access 1 · Oct 9
  • Persistence 1 · Oct 9
  • Reconnaissance 1 · Oct 9

what we reported, newest first, grouped by story

Oct 9 – October 11, 2026 · 3 reports

  • CISA added five flaws to KEV off the back of Flax Typhoon activity, including CVE-2015-3306 (ProFTPD, CVSS 10.0) — the federal remediation deadline is today, 11 October. The Hacker News · Oct 11 · observed · Vulnerabilities & Exploits
  • The FBI and DoJ seized seven domains used by Flax Typhoon (also tracked as Ethereal Panda and RedJuliett, linked to Beijing contractor Integrity Technology Group), disrupting two tools: MicroScan, a Python web tool bundling over 1,300 pentest scripts targeting OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins and Apache Struts, in use since as early as 2017 and still reachable via c0cc[.]cc as recently as 9 September 2026; and FishHub, whose confirmed victims include 20 Taiwanese universities. Court documents also detail a Mirai-variant IoT botnet managed by an application called Sparrow, whose database held records for more than 1.2 million infected devices as of 5 June 2024 — including over 385,000 unique U.S. devices, with roughly 126,000 U.S. devices actively infected at that point. The Hacker News, BleepingComputer · Oct 11 · observed · Threat Activity
  • An international coalition seized seven domains behind Microscan and FishHub, the vulnerability-scanning and spear-phishing tools tied to Flax Typhoon and Beijing-based Integrity Technology Group; Microscan drove a Mirai-based botnet to scan for exploitable flaws, with targets including a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms, universities and a multinational NGO (DOJ, The Record). Companion advisory AA26-281A details the TTPs — scanning, XSS, password spraying against Exchange, persistence via VPN software, scripted email and credential exfiltration — across government, critical manufacturing, healthcare and IT, with IOCs and CVEs newly added to KEV (CISA, NCSC-UK). · Oct 9 · observed · as integrity technology group · Threat Activity