A botnet torn down in 2024 left its scanner running
Seven seized domains show Flax Typhoon’s scanning tool outlived the 260,000-device botnet it built for.
By The Signal · · 5 min read
In September 2024, the FBI announced it had dismantled a 260,000-device botnet run by a Chinese state-linked hacking group called Flax Typhoon. On October 8, 2026, the FBI seized seven more domains tied to the same operation — because the botnet was never the whole toolkit. A vulnerability scanner called Microscan and a data-theft tool called FishHub kept running, infecting roughly 20 Taiwanese universities as recently as March.
Seven domains, one company, and a contract nobody's seen
The FBI's unsealed court documents name the company allegedly behind both tools: Integrity Technology Group, a Chinese security firm the US government says holds contracts with Beijing. One domain, c0cc[.]cc, gave Integrity Tech access to Microscan, the scanning tool used to probe networks for weaknesses before an intrusion. Five others — 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net — delivered FishHub, the tool that did the actual stealing: building a file listing on a compromised machine, searching for specific documents, compressing them, and shipping them to a server the attackers controlled. A seventh domain rounds out the seizure. Seven governments — the US, UK, Australia, Canada, Japan, New Zealand, and Spain — co-signed the advisory describing how the two tools worked together, which is the detail that matters more than the seizure itself.
The number is 260,000, and it describes the wrong machine
The figure everyone remembers from 2024 is 260,000 — the size of the Mirai-based botnet Flax Typhoon tore down after the FBI's first disruption campaign. That number measured infected routers and IoT devices, the botnet's foot soldiers, used mostly to mask the operators' true location and launch scans without pointing back to Beijing. It said nothing about Microscan or FishHub, which are separate, smaller, and purpose-built tools that don't need 260,000 devices to work. A scanner needs one connection to a target network. A data-exfiltration tool needs one foothold. Tearing down the botnet removed the camouflage, not the tools doing the actual intrusion and theft — which is why the FBI is still seizing domains two years after declaring that disruption a win.
Think of the botnet as the delivery trucks, not the warehouse
The distinction is closer to a shipping operation than a single criminal act. The botnet was the fleet of unmarked trucks — hundreds of thousands of compromised routers and cameras — used to move traffic around without anyone tracing the route back to a depot. Microscan was the clipboard used to case a building before a break-in: scanning Microsoft Exchange servers, probing for cross-site scripting weaknesses, testing passwords. FishHub was the crew that went in afterward, built an inventory of what was inside, packed up the valuable files, and carried them out through a different exit — the five domains that resurfaced after 2024. Seizing the trucks doesn't close the warehouse, and it doesn't fire the crew. That's the operational logic the advisory from CISA, the FBI, NSA, and six foreign agencies is now trying to make explicit, five newly catalogued vulnerabilities at a time.
The counter-argument: domain seizures rarely stick, and everyone involved knows it
The strongest challenge to calling this progress is the track record of the tactic itself. Domain seizures disrupt infrastructure, not operators. Integrity Technology Group doesn't need c0cc[.]cc to exist — it needs a domain registrar willing to sell it a new one, which takes an afternoon, not a court order. The same pattern played out with the botnet: the FBI's 2024 takedown was a genuine operational hit, cutting off hundreds of thousands of compromised devices from their controllers, yet by this year both private researchers and Western governments were separately warning that Chinese-linked actors were still hijacking routers and IoT hardware for new infrastructure. The advisory itself documents known intrusions running from 2022 — a US power company in South Carolina, Japanese and Polish airports, Taiwanese natural gas and power operators, two Taiwanese universities — through a 2026 disclosure. That's a four-year operational window the seizures didn't close; they followed it. Seizing domains makes a specific delivery mechanism unusable. It doesn't touch the company writing the code, the scanning methodology documented in court filings, or the five newly catalogued vulnerabilities actors will keep exploiting on networks that haven't patched them yet.
What the five CVEs actually buy defenders
The practical output of this advisory isn't the seizure — it's CISA's addition of five CVEs to its Known Exploited Vulnerabilities catalog, a list that obligates US federal civilian agencies to patch on a deadline rather than a convenience schedule. That's the lever with teeth: a scanning tool is only dangerous against an unpatched target, and Microscan's documented targets — Exchange servers reachable from the internet, VPN appliances used for persistence — are exactly the systems that sit exposed for months after a patch ships because patching them means downtime. The advisory's mitigation list reads almost apologetically basic: disable unused ports, sanitize web inputs, turn on multi-factor authentication, apply patches promptly. None of that requires new technology. All of it requires an organization to actually do routine maintenance on infrastructure it would rather not touch, which is the gap Flax Typhoon-enabled actors have spent four years walking through.
The constraint nobody in the advisory names
Seven countries signed this advisory, and Spain's Centro Nacional de Inteligencia is on the list for the first time alongside the usual Five Eyes partners plus Japan — a sign the targeting has spread well past critical infrastructure and into universities, religious organizations, and law enforcement networks across Southeast Asia, Africa, and North America. But no advisory, seizure, or CVE listing addresses the fact that Integrity Technology Group is a company operating inside China, allegedly under contract to the Chinese government, and outside the reach of any of the seven signatories' courts. The FBI can seize a domain registered through a Western registrar. It cannot compel a Chinese firm to stop writing scanning software, and it has no mechanism to verify whether Flax Typhoon's operators have already built the next version of FishHub under a different name, routed through domains nobody has found yet. The 2024 botnet takedown proved that disruption works on infrastructure built with Western-facing components. It also proved, by the company's continued operation through March 2026, that disruption and dismantlement are not the same verb.