International Coalition Seizes Integrity Tech Tools Used in Flax Typhoon Campaign Against Critical Infrastructure
The takedown targets the tool layer, not the operator layer. Integrity Tech's Microscan and FishHub were reconnaissance and delivery mechanisms—the actual intrusions, lateral movement, and data exfiltration were conducted by PLA Unit 61398, MSS Technical Reconnaissance Bureau, or affiliated contractors whose identities the advisory does not disclose. Shutting down two websites does not disrupt the attackers' ability to conduct hand-on-keyboard operations or deploy custom malware through other channels; it merely forces them to rebuild or repurpose existing tools.
China's cyber attack infrastructure just lost two of its primary reconnaissance and intrusion platforms, but the real constraint is enforcement: Integrity Tech itself remains operational, its personnel are still employed by MSS proxies, and the tools' source code is already cached across dozens of Chinese military and intelligence networks.
The 58-page technical advisory published by FBI, CISA, and NSA names the specific vulnerabilities and attack chains—which means every Chinese contractor with a copy now has a roadmap for rebuilding Microscan and FishHub variants within weeks. Watch whether the Justice Department attempts asset seizure against Integrity Tech's U.S.-based financial holdings or whether this takedown was purely symbolic infrastructure disruption with no follow-on enforcement action.
Did the FBI identify the specific MSS unit or contractor that operationally controlled Integrity Tech, or does the Justice Department's complaint treat the company as a standalone actor? The distinction determines whether this is a disruption of a tool or a disruption of a command relationship.
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.