FBI seized MicroScan. CISA put five of the exploited CVEs on KEV.

AA26-281A is Integrity Tech, not a new 0-day. SoftEther named conhost is the persistence. The due date is 11 October.

RWP Ventures · 2026-10-09 · event 2026-10-08 · 15 min read · priority 9.1

The same day, DOJ and FBI announced court-authorized seizures of two Integrity Tech platforms: MicroScan (vulnerability scanning; more than 1,300 scripts) and FishHub (spear-phishing follow-on). DOJ: Integrity Tech has contracts with the PRC government. This is the Department’s second public technical disruption of the company after the September 2024 Mirai botnet takedown (more than 200,000 consumer devices).

The operational ticket for SOCs is not the seizure. It is the KEV freeze. CISA’s catalog moved from 2026.10.04 / 1734 (last add [CVE-2026-88779](/posts/2026-10-05-netscaler-cve-2026-88779-kev/)) to 2026.10.08 / 1739, released 20:09 UTC. Appendix B of AA26-281A lists eight successfully exploited CVEs recovered from Integrity Tech penetration-testing scripts. Five of those eight, marked with an asterisk in the CSA, were added to KEV the same day. Federal due date: 11 October 2026. Four of the five carry forensicTriage: Yes.

Do not collapse four facts.

1. Seizing MicroScan does not evict SoftEther. The CSA’s persistence is a legitimate VPN client installed on the victim, often named conhost.exe or dllhost.exe, set to reconnect at startup. A domain seizure in Pennsylvania does not uninstall that client, does not rotate the mailbox the EBurst spray already opened, and does not close Pulse, GitLab, or Struts that were already reachable.
2. The new KEV rows are 2015–2023 bugs this actor used, not a 2026 0-day. ProFTPD CVE-2015-3306, BIND CVE-2015-5477, Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199, Strapi CVE-2023-22894. Pulse CVE-2019-11510, GitLab CVE-2021-22205, and Bash CVE-2014-6278 were successfully exploited in the same appendix and were already on the catalog.
3. A scanned power company is not a confirmed process write. DOJ names MicroScan targeting that includes a South Carolina power company, Japanese and Polish airports, and Taiwanese natural-gas and power firms. That is reconnaissance. CISA’s press quote about PRC actors in OT is a general statement, not a finding in this CSA that Integrity Tech wrote a PLC.
4. This is not FortiBleed and not FortiMail. Yesterday’s Daily Top was [JCSA-20261006-01](/posts/2026-10-08-fortibleed-fbi-usss-lockouts/). Different agencies, different product, different mechanism.

What happened

Integrity Tech is not a new name. UK sanctioned it in 2025. The EU sanctioned it in March 2026. DOJ disrupted its Mirai botnet in September 2024. What is new this morning is a nine-organization CSA built from multiple FBI investigations, a pair of tool seizures unsealed in the Western District of Pennsylvania, and a five-row KEV add that is the catalog consequence of Appendix B.

MicroScan. CSA: a Python web application in use as early as 2017, holding more than 1,300 penetration-testing scripts. Targets named in the reconnaissance chapter include OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. DOJ: Integrity Tech accessed it through c0cc[.]cc, one of the seized domains, and used a Mirai IoT botnet to scale the scanning. DOJ-named scan targets: a U.S. power company in South Carolina, a multi-national NGO, Japanese and Polish airports, Taiwanese natural-gas and power companies, two Taiwanese universities.

FishHub. DOJ, not the CSA glance table: spear-phishing follow-on. After initial compromise it pulled additional malware that either opened remote access for Integrity Tech’s clients or searched for named files and sent them out. Confirmed FishHub victims in the affidavit coverage: about 20 Taiwanese universities. Five seized domains DOJ ties to that malware path: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net.

How they stay. SoftEther, a real VPN product, installed with PowerShell, LOLBins, curl, or wget, configured to auto-reconnect, often stored on the server. CSA-listed hub domains include 98aiblog[.]com, hmbcloud[.]com / .net, hmbiplc-01[.]com, javacheck.ooguy[.]com, javaupdate.giize[.]com. The point of the VPN is to make C2 look like a staff remote-access tool.

How they take mail. EBurst against Microsoft Exchange / Microsoft 365: password spray and guess across ECP, EWS, OAB, OWA, RPC, API, MAPI, PowerShell, Autodiscover, ActiveSync. A separate PHP bot (Curlc4.txt) talked to EWS, compressed mail, sometimes RC4 or AES-128-CBC, C2 on natcloudservice[.]com / upl.natcloudservice[.]com (example IP 149.28.132[.]137). An XSS payload recovered by FBI dropped live700_v1.exe, which spawned DiagTrack.exe and talked to dns.studiocloud[.]xyz.

BleepingComputer’s 8 October 17:42 write-up is how most SOCs will see the seizure. The CSA and the KEV JSON are the primary.

Why it matters

Integrity Tech is being treated as an enabler, not as a single APT brand. The CSA’s audience is government, FCEB, SLTT, and critical infrastructure — specifically Government Services, Critical Manufacturing, Healthcare, and IT, plus U.S. law enforcement, education, and religious organizations, and victims in Southeast Asia, Africa, and North America. That is who runs Exchange, GitLab, Pulse, and leftover ProFTPD.

Three operational lies are now in the ticket.

1. “The FBI took the scanner, so we are done.” MicroScan and FishHub being unreachable is a capability loss for the next scan cycle. It is not a statement about the SoftEther client that was installed in 2024, the Exchange mailbox EBurst already opened, or the GitLab CE that still answers CVE-2021-22205. Hunt first.
2. “These CVEs are a decade old, we patched them in 2016.” CISA added them to KEV on 8 October because Appendix B says they were successfully exploited in this activity. The due date is 11 October. Struts CVE-2016-3081, ProFTPD CVE-2015-3306, ONLYOFFICE CVE-2021-3199, and Strapi CVE-2023-22894 all have forensicTriage: Yes. Patching without looking for the webshell, the copied file, or the chained RCE is how you keep the mailbox dump.
3. “Critical manufacturing in the audience line means OT compromise.” The CSA’s confirmed collection is email, credentials, and databases. DOJ’s power-company sentence is a scan target. Chris Butera’s press-release line about PRC actors in OT is a general positioning statement. It is not a PLC write in this advisory.

A water or energy operator whose GitLab, Pulse, or Exchange is on the internet has an IT problem until logs show a process write. None are in AA26-281A.

Who / what is affected

Technical context

RWP is not reproducing MicroScan scripts, EBurst wordlists, or a SoftEther install recipe. The defender cut in the CSA is enough.

Access path. Internet scan of 21/22/53/80/443/1080 (T1595.002). MicroScan scripts against leftover CMS, FTP, Struts, GitLab, Pulse, Shellshock (T1190). XSS credential harvest dropping live700_v1.exe (T1189, T1036.003). EBurst against Exchange interfaces (T1110.003, T1110.001). SoftEther for durable C2 (T1133). EWS bot and mailbox tooling for mail (T1114.002, T1020). Secretsdump-class tooling shows up in Appendix A hashes; that is credential dumping after access (T1003), not the initial bug.

The five new KEV rows, as CISA wrote them.

Ransomware use on all five: Unknown. Required action is BOD 26-04 language, not a unique ISO. Due 2026-10-11.

Hunting artifacts the CSA actually printed (leads, not a blocklist of the internet):

Staged dump names the CSA listed: 001.gif, Css.js, Include.png, M2k.js, All_scanner_vXX.pl.gz. A GIF in a web root that is a MySQL dump is the ticket, not a new file-format CVE.

ATT&CK mapping from the CSA, not a kill chain we ran:

Threat / exploitation status

Confidence on the CSA, the seizures, the KEV add, and the SoftEther persistence class: high. Confidence that every Appendix B CVE is still exposed in a given estate: low until inventoried. Confidence of 1:1 Flax Typhoon branding: moderate (agencies themselves refuse it). Confidence of process impact: none claimed.

What defenders should do

1. Treat 11 October as the close for the five new KEV rows, not as the start of a meeting. Inventory internet-facing ProFTPD, Struts (especially DMI / REST plugins), ONLYOFFICE Document Server, Strapi admin panels, and BIND 9 that still answers TKEY. BOD 26-04 forensic triage applies to four of the five. If the box was public, assume the script ran.
2. Hunt SoftEther as if the scanner seizure did not happen. Unexpected conhost.exe / dllhost.exe that is not Windows. Unexpected SoftEther services. Auto-start VPN clients. The CSA hub domains above, plus dns.studiocloud[.]xyz and natcloudservice[.]com. A hit is a lead; seized domains displaying an FBI splash are not a clean bill for the client that already connected.
3. Cover the Exchange interfaces EBurst actually uses. ECP, EWS, OAB, OWA, RPC, MAPI, PowerShell, Autodiscover, ActiveSync. Look for spray volume, then for mailbox pulls and compressed dumps with the staged names above. MFA on those paths is the CSA’s ICAM line, not a substitute for the hunt.
4. Re-check the three Appendix B CVEs that were already on KEV. Pulse CVE-2019-11510, GitLab CVE-2021-22205, Bash CVE-2014-6278. If those still answer on an untrusted network, they are in the same MicroScan script pack as the five new rows. Last year’s GitLab ticket does not close this year’s scan.
5. Do not wait for a new Fortinet-style ISO. There is no Integrity Tech firmware. Eviction is: isolate the host that ran SoftEther, rotate the mailbox and service accounts that EBurst could have guessed, pull the KEV products off the internet or patch them, and rebuild anything that staged 001.gif in a web root.
6. Keep the rest of this window on the board, separately. [FortiBleed JCSA-20261006-01](/posts/2026-10-08-fortibleed-fbi-usss-lockouts/) is still a credential campaign against FortiGate SSL VPN. Splunk CVE-2026-76268 (Patroni REST, 9.8, search-head cluster 10.4.x / 10.2.x, workaround disabled = true under [postgres]) has no claimed exploitation. Tenable Identity Exposure CVE-2026-106126 is command injection as SYSTEM on the PDCe via the AD Events Listener; Tenable says upgrade to 3.126.0 and reinstall the listener with Register-TenableIOA.ps1 -Uninstall — SaaS bump without the uninstall is not the fix. Microsoft’s 9 October early updates include Exchange CVE-2026-96940 (8.8, Exploitation More Likely) and cloud CVEs through Partner Center CVE-2026-96207 (10.0); none of those are on this KEV freeze. CISA ICS the same day: Red Lion N-Tron 700 (ICSA-26-281-01, no known public exploitation) and GPA openPDC/openHistorian (ICSA-26-281-02, 9.8 deserialization, no known public exploitation, Docker image no fix planned). Those are OT tickets. They are not this CSA.

RWP assessment

Highest-leverage new development since [yesterday’s FortiBleed Daily Top](/posts/2026-10-08-fortibleed-fbi-usss-lockouts/) is the joint CSA plus the KEV freeze it forced. Evidence quality is high: nine authoring organizations, FBI investigations, a DOJ seizure with named domains, and a catalog JSON that moved 1734 → 1739 with five Appendix B asterisks. Exploitation evidence is high for the eight CVEs as a class, high for mail collection and SoftEther persistence, and zero for a confirmed process write.

It outranks Tenable CVE-2026-106126 because a 9.9 SYSTEM injection on the PDCe is a real identity-tool bug with no claimed exploitation and a reinstall step that most tenants will miss — it is not a nine-agency CSA. It outranks Splunk CVE-2026-76268 because that 9.8 was already on yesterday’s board as unexploited-as-published. It outranks Microsoft’s 9 October early cloud/Exchange set because those are vendor-patched, not KEV, and Exchange in this story is EBurst, not CVE-2026-96940. It outranks Red Lion and openPDC because CISA says no known public exploitation; they belong in the weekly OT pile. It outranks a second FortiBleed day because JCSA-20261006-01 was yesterday’s ticket and this CSA is a different actor class.

What we are not saying: that Flax Typhoon is Integrity Tech as a legal identity; that the seizure cleaned victim networks; that five 2015–2023 CVEs are 2026 0-days; that a South Carolina power company lost generation; that this replaces FortiBleed or FortiMail.

Confidence on the advisory, the seizures, the KEV add, and SoftEther as the persistence class: high. Confidence on current live-compromised inventory: low. Confidence of ongoing use of leftover Appendix B exposure: high.

What we are watching

• Whether Integrity Tech rebuilds MicroScan/FishHub on new domains (FBI San Diego said they will watch for rebuild).
• Whether Pulse CVE-2019-11510 or GitLab CVE-2021-22205 get a fresh KEV note tying them to this freeze rather than their original rows.
• SoftEther-as-conhost detections in industrial and government estates that are still IT persistence, not process impact.
• Splunk CVE-2026-76268 and Tenable CVE-2026-106126 moving from vendor-advisory to KEV.
• GPA openPDC CVE-2026-100730 if energy-sector telemetry shows the unauthenticated deserializer, which CISA has not claimed.
• Catalog freeze leaving 2026.10.08 / 1739 or adding a sixth row before Sunday’s due date.

Sources

• CISA — AA26-281A
• CISA — Integrity Tech press release, 8 October 2026
• CISA — AA26-281A PDF
• CISA — AA26-281A STIX JSON
• DOJ — MicroScan / FishHub seizure, 8 October 2026
• FBI IC3 — CSA 261008 (PDF)
• CISA — KEV JSON catalog 2026.10.08
• CISA — Known Exploited Vulnerabilities Catalog
• NCSC-UK — Integrity Tech joint advisory
• BleepingComputer — FBI seizes Flax Typhoon tools, 8 October 2026
• Recorded Future / The Record — Integrity Tech tool seizure
• SecurityWeek — US disrupts Chinese state-sponsored hacking tools
• CISA — ICSA-26-281-01 Red Lion N-Tron 700
• CISA — ICSA-26-281-02 GPA openPDC / openHistorian
• Splunk — SVD-2026-1001
• Tenable — TNS-2026-27
• MSRC — October 2026 Early Security Updates
• [RWP — FortiBleed FBI/USSS Daily Top, 8 October 2026](/posts/2026-10-08-fortibleed-fbi-usss-lockouts/)
• [RWP — NetScaler 88779 KEV Daily Top, 5 October 2026](/posts/2026-10-05-netscaler-cve-2026-88779-kev/)