FBI Seizes FishHub as Advisory Exposes Flax Typhoon Mailbox Theft

Government offices, police agencies, health systems and religious institutions in Southeast Asia lost email to this crew. In some cases the stolen mail could be opened only from IP addresses in Xiamen, China. The FBI says it recovered an archived email database the actors used to target victim mailboxes.

The seizure is the headline. The mailbox tradecraft is the part defenders can use. None of the eight vulnerabilities the advisory lists is an Exchange bug. The mailbox access it describes runs on guessed or harvested passwords and Microsoft's own APIs.

Key Takeaways

• The Justice Department announced on October 8, 2026 the court authorized seizure of domains supporting MicroScan, a vulnerability scanner, and FishHub, a spear phishing tool, both operated by Beijing based Integrity Technology Group.
• Joint advisory AA26-281A, coauthored by the FBI, CISA, NSA and agencies in the UK, Australia, Canada, Japan, New Zealand and Spain, says the actors password sprayed Microsoft Exchange servers with the open source tool EBurst and exfiltrated email with scripts.
• The FBI recovered an archived email database; victims of the email theft included government organizations, law enforcement agencies, healthcare systems and religious institutions in Southeast Asia.
• A PHP bot called Curlc4 pulled mail through Exchange Web Services, an API Microsoft began disabling by default in Exchange Online on October 1, 2026 but is not retiring in on premises Exchange Server.
• The Justice Department's press release says FishHub hit about 20 Taiwanese universities, while the FBI affidavit behind the seizure counts files from more than 20 entities, six of them identified as Taiwanese universities.

What Did the FBI Seize From Integrity Tech?

The FBI seized seven internet domains that Integrity Tech used to run MicroScan, FishHub and its remote access infrastructure. The Justice Department release describes Integrity Tech as a PRC company that "has contracts with the PRC government," and says the tools were used "to scan and, in some cases, hack, U.S. and foreign critical infrastructure systems."

The seizure affidavit, sworn by an FBI San Diego agent in the Western District of Pennsylvania, lists the seven targets:

• c0cc[.]cc: its subdomain x.c0cc[.]cc still served the MicroScan login page on or about September 9, 2026.
• 98aiblog[.]com: SoftEther VPN software used a subdomain of it to connect two compromised Taiwanese university servers to a Flax Typhoon server in August 2024.
• 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net: the five FishHub delivery domains.

Three of those names borrow from Outlook, YouTube and LinkedIn. MicroScan itself dates back to at least 2017, according to the advisory, and holds "over 1,300 penetration testing scripts." DOJ says its scan targets included a South Carolina power company, a multinational NGO, Japanese and Polish airports, and Taiwanese gas and power companies.

What Is FishHub, and Who Did It Hit?

FishHub is a phishing delivery tool that drops a script on a victim's machine, pulls more malware, then searches for, compresses and exfiltrates selected files. Its source code, quoted in the affidavit, saves the first download as a .vbe script in the Windows temp folder.

The victim count depends on which DOJ document you read. The press release says "Confirmed victims of FishHub activity included approximately 20 Taiwanese universities." Paragraph 37 of the FBI affidavit is narrower: the FishHub server held "data and files from more than 20 different entities," and commands on it "showed that six of the targeted entities were Universities located in Taiwan." Both can be true, but only the sworn document supports the number six.

Payment records tie the domains together. The affidavit says the five FishHub domains were renewed on or about February 10, 2026 from a single IP address with funds from AliPay, and that c0cc[.]cc was bought and renewed through an Alipay account with a Beijing address.

How Did the Crew Break Into Mailboxes?

The route the advisory documents in most detail is password guessing. Advisory AA26-281A says the actors used EBurst, "an open source Python-based tool," to compromise email accounts on Microsoft Exchange servers through password spraying and password guessing. EBurst can aim at ten Exchange interfaces:

• Outlook Web Access, Exchange Control Panel and Exchange Web Services (EWS)
• MAPI, RPC, Offline Address Book and Autodiscover
• PowerShell, an API interface and Microsoft-Server-ActiveSync

The advisory's instruction is blunt: "Network defenders should include these interfaces when defending against EBurst." Monitoring that covers only the OWA login page covers one of the ten.

The second route was a fake login form. The FBI recovered a cross site scripting payload that, run on a vulnerable website, draws username and password fields on the page. After any credentials are typed, it offers a password protected zip containing live700_v1.exe, which starts a process named DiagTrack.exe, a name it shares with legitimate Windows software. Because the executable has functions to query mailboxes, "the FBI assesses the malware likely targets user email data for exfiltration."

What Happened to the Stolen Mail?

It was scripted out, disguised and sometimes locked so only Xiamen addresses could read it. The advisory PDF on IC3 describes three pieces:

• Curlc4.txt, a PHP bot "specifically designed to interface with the Microsoft EWS API," could reach email along with calendars and contacts. It compressed the mail, sometimes encrypted it with RC4 or AES-128-CBC, and uploaded it to a remote server; its main command domain was natcloudservice[.]com.
• office-cli, a Linux command line utility, "continuously" pulled Outlook 365 mail across time periods using config files holding a client_id, tenant_id and secret.
• Camouflaged staging. The crew renamed MySQL email dumps to 001.gif, Css.js, Include.png and M2k.js before moving them out.

The crew also ran "a custom web application that provides third-party access to stolen email content," where users could put arguments in a URL to read a specific account. In some cases access to the exfiltrated data was restricted "to only IP addresses from Xiamen, China." That is a mailbox reading service, not a smash and grab.

Why Email Users Should Care: The API Clock Just Started

The timing is better than anyone planned. Curlc4 is built on EWS, and Microsoft's Exchange team says in its EWS retirement post that any tenant with EWSEnabled still at Null on October 1, 2026 "will see the value changed to False," which "will block EWS for all applications in the tenant." Full shutdown follows on April 1, 2027.

There are two gaps. First, tenants can set EWS back to True and keep an AppID allow list, so the API stays open for whatever that list admits. Second, the post says there are "no changes to EWS in Exchange Server." The advisory says the crew stole mail "from on-premise systems and cloud-based services," so on premises servers keep the exact interface Curlc4 was written for.

office-cli points at a third. A client ID, tenant ID and secret are what Microsoft's client credentials flow uses for apps that "run in the background, without immediate interaction with a user," and Microsoft Graph offers such apps permission to read mail in all mailboxes. The advisory does not say which API office-cli calls, only that the crew evades detection with it "by using legitimate access methods." Retiring one API does not revoke an app's mailbox permissions. It is the same lesson as the password spraying wave that slipped past MFA through ROPC: attackers look for the authentication path nobody is watching.

How Should Mail Admins Defend Against EBurst and Curlc4?

Close the password paths, then audit the API paths. These steps follow the advisory's mitigations and Microsoft's documentation:

1. Hunt with the IOCs, carefully. Appendix A lists, by our count, 218 domain names and 515 IP addresses, plus STIX files. The authors warn some IOCs "date back to as early as 2016" and should be vetted before blocking.
2. Require MFA on webmail first. The advisory asks for MFA "particularly for webmail, VPNs, and accounts that access critical systems." In Microsoft 365, block legacy authentication with Conditional Access and tune smart lockout.
3. Shrink on premises exposure. Keep ECP and PowerShell off the internet if you can, and switch off EWS for mailboxes that never use it with the settings in Microsoft's EWS access guide. Exposed servers remain common, as the 21,899 Exchange servers still open to mailbox hijack showed in September.
4. Own your EWS allow list. Build it yourself rather than accepting Microsoft's usage based list, which could include apps you did not know about.
5. Audit app registrations. Follow the advisory: "Monitor cloud accounts for connected applications that can access sensitive data in file systems and email data," and rotate service account keys.
6. Look for Curlc4 artifacts. The advisory says the bot appears to run stand alone rather than on a compromised device, but it also lists files that indicate it ran on a system: a storage/fm directory, a .run file, clientid and cp files, plus the string /var/tmp/.sess.zip. Check proxy logs for natcloudservice[.]com.
7. Watch outbound volume and odd logons. The advisory flags workstations with unusually high upload traffic and "impossible time and distance logons."

What Should Journalists, NGOs and Religious Groups Do?

Assume your mailbox is the target, because in this case it was. Religious institutions sit on the advisory's victim list next to law enforcement and health systems, and China linked crews have phished journalists with fake Google alerts this year.

• Get a security key or passkey on your work email. CISA's phishing resistant MFA fact sheet names password spraying among the attacks MFA stops.
• Never type a password into a form that appears unexpectedly on a site you trust, and never open a password protected zip it hands you afterward.
• Ignore software updates sent by email. The advisory says plainly: do not trust messages "claiming to provide software updates as attachments or via links."
• Ask your IT provider one question: have you checked our mail server against AA26-281A?

Looking Ahead: Strike Three Against One Contractor

U.S. Attorney Troy Rivetti called the seizures "our second disruption of Integrity Tech's massive operations in as many years." Counting sanctions, it is at least the third public U.S. action against the company. In September 2024 the FBI disrupted its Mirai botnet; the affidavit says the botnet's database "contained records of over 1.2 million infected devices," with over 260,000 actively infected as of approximately June 5, 2024. On January 3, 2025, Treasury sanctioned Integrity Tech.

The SoftEther habit outlasted public exposure. Microsoft described Flax Typhoon running SoftEther VPN inside Taiwanese networks in August 2023; the 2026 advisory documents the same persistence trick, with SoftEther hosts last seen as late as December 2024, more than a year later. Domains are cheap to replace. The useful thing this week is the mailbox playbook, now public for every defender to test against.