DOJ, FBI Seize Flax Typhoon Hacking Tools Microscan and FishHub Linked to Integrity Tech
The seizure targets the tools, not the operators or the persistence mechanisms already in place. Flax Typhoon's documented technique involves establishing VPN and credential access first, then using scanning tools to map the network for future disruption—removing Microscan and FishHub forces the group to source alternative scanning tools (readily available open-source alternatives exist) or delay operations, but does not remove the initial foothold. The real constraint is visibility: CISA's advisory now forces critical infrastructure operators to hunt for signs of the group's presence, which either flushes out compromised networks or signals to Flax Typhoon that its operations are exposed, likely accelerating any planned disruption timeline.
Flax Typhoon has positioned itself inside critical infrastructure operational technology (OT) networks with explicit intent to disrupt them at a chosen moment; this seizure removes two of the group's primary reconnaissance and access tools, but does not eject them from networks already compromised.
Integrity Tech was sanctioned in 2025 and dismantled in a 2024 takedown operation, yet continues operating—the domain seizure is tactical disruption, not elimination. Watch whether the advisory triggers network isolation orders from CISA to critical infrastructure operators, or whether the FBI announces arrests of Flax Typhoon operators or Integrity Tech personnel within 60 days.
How many U.S. critical infrastructure networks currently host Flax Typhoon implants, and has CISA conducted a systematic sweep to identify and isolate them?
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.