{
  "id": 13641829,
  "title": "Flax Typhoon Unmasked: Inside the FBI's Global Takedown of China's Hacking-for-Hire Empire",
  "url": "https://urgent.news/2026/10/11/flax-typhoon-unmasked-inside-the-fbis-global-takedown-of-chinas",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-11T04:34:26.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/techpulse01239/flax-typhoon-unmasked-inside-the-fbis-global-takedown-of-chinas-hacking-for-hire-empire-17eo"
  },
  "original_language": "en",
  "account": "The FBI, Justice Department, and cybersecurity agencies from seven allied nations dismantled a Chinese state-sponsored hacking-for-hire empire based in Beijing, according to an October 8 joint advisory. The operation targeted Integrity Technology Group, a Shanghai Stock Exchange-listed company that Western officials claim acted as a front for Chinese state-sponsored hackers. The takedown involved two core platforms, MicroScan and FishHub, which were seized and revealed a far-reaching campaign to steal sensitive information from governments, hospitals, law enforcement, and religious institutions worldwide. MicroScan, a vulnerability scanner, probed networks for weak spots using a botnet of hijacked Internet of Things devices infected with a variant of Mirai malware, while FishHub was a spear-phishing and data-theft platform. The hackers operated a web application allowing third-party access to stolen email content, with compromised inboxes catalogued and browsable to outside parties. The campaign, which began at least in 2021, relied on automated scanners, known vulnerabilities, and password-spraying attacks against Microsoft 365 and Exchange accounts. The affected victims included government, law enforcement, healthcare, and religious institutions across Southeast Asia, Africa, North America, and the United States. The attackers used custom email-harvesting tools and established persistence using SoftEther VPN clients disguised as legitimate Windows processes. The case highlights how Beijing outsources cyber operations to commercial contractors, blending profit with state-aligned espionage. While the seizure is a temporary setback, officials urge organizations to patch aggressively, enforce multi-factor authentication, monitor for anomalous Exchange Web Services traffic, and assume ongoing credential attacks.",
  "summary": "The FBI, the U.S. Justice Department, and cybersecurity agencies from seven allied nations have unmasked a major Chinese hacking-for-hire empire, dismantling the infrastructure of Beijing-based Integrity Technology Group. The operation, which took place on October 8, revealed that the company operated as a commercial front for Chinese state-sponsored hacking, stealing email from governments, hospitals, law enforcement agencies, and religious institutions around the world. The takedown involved two core platforms, MicroScan, a vulnerability scanner, and FishHub, a spear-phishing and data-theft platform. The operation is part of a multi-year, multi-continent campaign dating back to at least 2021, involving automated scanners, exploited known vulnerabilities, and custom email-harvesting tools.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}