#flax-typhoon

October 11, 2026

CISA added five flaws to KEV off the back of Flax Typhoon activity, including CVE-2015-3306 (ProFTPD, CVSS 10.0) — the federal remediation deadline is today, 11 October. The Hacker News · Vulnerabilities & Exploits
The FBI and DoJ seized seven domains used by Flax Typhoon (also tracked as Ethereal Panda and RedJuliett, linked to Beijing contractor Integrity Technology Group), disrupting two tools: MicroScan, a Python web tool bundling over 1,300 pentest scripts targeting OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins and Apache Struts, in use since as early as 2017 and still reachable via c0cc[.]cc as recently as 9 September 2026; and FishHub, whose confirmed victims include 20 Taiwanese universities. Court documents also detail a Mirai-variant IoT botnet managed by an application called Sparrow, whose database held records for more than 1.2 million infected devices as of 5 June 2024 — including over 385,000 unique U.S. devices, with roughly 126,000 U.S. devices actively infected at that point. The Hacker News, BleepingComputer · Threat Activity

October 9, 2026

An international coalition seized seven domains behind Microscan and FishHub, the vulnerability-scanning and spear-phishing tools tied to Flax Typhoon and Beijing-based Integrity Technology Group; Microscan drove a Mirai-based botnet to scan for exploitable flaws, with targets including a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms, universities and a multinational NGO (DOJ, The Record). Companion advisory AA26-281A details the TTPs — scanning, XSS, password spraying against Exchange, persistence via VPN software, scripted email and credential exfiltration — across government, critical manufacturing, healthcare and IT, with IOCs and CVEs newly added to KEV (CISA, NCSC-UK). · Threat Activity