Integrity Technology Group's Microscan and FishHub Tools Abused by Flax Typhoon APT
In October 2026, law‑enforcement seized the infrastructure of Integrity Technology Group, a Shanghai‑listed firm that operated MicroScan—a Mirai‑variant IoT botnet vulnerability scanner with >1,300 penetration‑testing scripts—and FishHub, a spear‑phishing platform that harvested Exchange Web Services mail via a custom PHP bot and hosted a browsable web portal for stolen email. The tools enabled credential‑spraying against Microsoft 365/Exchange, persistence via SoftEther VPN clients masquerading as legitimate Windows processes, and large‑scale scanning of government, healthcare, critical‑infrastructure, and educational targets across North America, Europe, Asia, and Africa. The disruption halted ongoing data exfiltration but defenders must assume reconstitution risk and enforce patching, MFA, and EWS monitoring.