Flax Typhoon outsourced its reconnaissance to a Mirai botnet

The part of the October 8 action that stopped me was not the intrusion. It was the scan. According to court documents unsealed in the Western District of Pennsylvania, Integrity Technology Group ran a network of internet-connected devices infected with a Mirai variant and pointed it at a vulnerability scanner of its own called MicroScan. The probes did not arrive from a bulletproof host you could geo-block. They came from routers and cameras in people's houses, each contributing a thin slice of a sweep against United States power infrastructure, airports in Japan and Poland, Taiwanese energy companies and universities.

The FBI and DOJ seized seven domains supporting MicroScan and a spearphishing platform called FishHub, seven governments published a joint advisory, and CISA added five exploited flaws to the Known Exploited Vulnerabilities catalog with a federal deadline of October 11. Three days, over a weekend.

The company doing the scanning

Flax Typhoon is a PRC state-linked espionage actor, tracked elsewhere as Ethereal Panda and RedJuliett and catalogued by MITRE as G1044. It exploits known flaws in internet-facing servers, drops the China Chopper web shell, then lives off the land rather than deploying custom malware, as Microsoft Threat Intelligence documented in August 2023. The advisory names government, critical manufacturing, healthcare, information technology, education, and religious organizations. Integrity Tech is a Beijing contractor holding PRC government contracts, sanctioned by the U.S. Treasury in January 2025, and this is the second takedown of its botnet in two years, after the Justice Department disrupted an earlier one in September 2024 holding over 200,000 consumer devices.

Reconnaissance as a service, delivered from people's living rooms

MicroScan did not run on infrastructure Integrity Tech visibly owned. It ran on the botnet, and the filings describe that botnet using MicroScan to scan victim networks for weaknesses that clients could later exploit. That clause is the whole story: reconnaissance and exploitation were separate functions performed by separate people, with the results handed off as a product.

That split defeats three controls most of us quietly rely on. The first is scan detection by source. Every WAF and edge appliance I have worked with treats a port scan as a rate problem attached to an address, so one source touching many ports in a short window trips a threshold and gets blocked. Spread that sweep across thousands of residential devices and each source sends a handful of probes indistinguishable from a misconfigured client, so nothing fires.

The second is reputation and geography. Those addresses are consumer broadband where your customers live, so blocklists built for hosting ranges have nothing to bite on, and a geo-block wide enough to catch the botnet catches your customers too.

The third is not a network control at all. It is the assumption inside your triage queue that an old vulnerability has decayed in risk. When a contractor builds scanning infrastructure around a fixed set of aging flaws and keeps it running across two seizures, the chance any exposed instance gets found stops decaying with the age of the CVE.

What is actually new, stated carefully

Botnets are old, scanners are old, and active scanning has sat in MITRE ATT&CK as T1595.002 for years. Two pieces of Flax Typhoon tradecraft are also being written up this week as though fresh, and both appeared in that same Microsoft report in August 2023: disabling Network Level Authentication and setting a debugger on the Sticky Keys binary so the RDP sign-on screen returns a local system process, and renaming the SoftEther client vpnbridge.exe to conhost.exe or dllhost.exe so a signed tunnel hides behind a Windows component name. Both are worth hunting. Neither is news.

So the claim here is documentary rather than technical. What changed on October 8 is that unsealed filings and a seven-government advisory put attributable detail behind a model we had mostly theorised about: contractor-operated reconnaissance, run on consumer hardware, decoupled from the operators who act on it, aimed at pre-authentication flaws old enough that most programs stopped treating them as live.

The five flaws

CVE	Product	Role in this chain	KEV	Source
CVE-2015-3306	ProFTPD 1.3.5 with mod_copy	Primary entry. Unauthenticated SITE CPFR and SITE CPTO give arbitrary file write, which becomes a web shell.	Due 2026-10-11. CVSS 10.0	Security Affairs
CVE-2016-3081	Apache Struts 2, Dynamic Method Invocation on	Alternate entry. A method: prefix evaluates attacker OGNL for code execution.	Due 2026-10-11. CVSS 8.1	Rapid7
CVE-2021-3199	ONLYOFFICE Document Server before 5.6.3	Alternate entry. Path traversal on the upload handler writes into the web root.	Due 2026-10-11. CVSS 9.8	Security Affairs
CVE-2023-22894	Strapi 3.2.1 up to 4.8.0	Credential theft. Filtering on private fields exposes password hashes and reset tokens.	Due 2026-10-11. NVD 4.9, CISA ADP 7.2	OpenCVE
CVE-2015-5477	ISC BIND 9	Support flaw. A crafted TKEY query crashes named, breaking resolution.	Due 2026-10-11. CVSS 7.5	Help Net Security

All five were added October 8. Three further flaws tied to this activity were already catalogued: CVE-2014-6278, CVE-2019-11510, and CVE-2021-22205.

Why a severity-sorted queue buries every one of these

The Strapi entry is the clearest case. NVD scores CVE-2023-22894 at 4.9, a medium, while CISA's own ADP enrichment puts the same flaw at 7.2, so a queue sorted on NVD files a KEV entry carrying a three day clock below several hundred 7.x findings nobody is exploiting. CVE-2015-3306 fails differently, because it scores 10.0 and severity was never the problem. Age is. An eleven year old ProFTPD finding somebody exception-tracked years ago does not resurface in a queue that ages out whatever lacks recent advisory traffic, which is exactly what this infrastructure exists to find. The BIND entry reads as an availability nuisance until you know it breaks resolution mid-intrusion.

How TRIS ranks these findings

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, decides these five on four layers rather than a base score.

Exposure. Is the instance reachable from the internet, and does it answer on the port this infrastructure probes? An exposed ProFTPD 1.3.5 and a segmented one are the same CVE and nowhere near the same finding.

Exploitation evidence. A KEV listing with a federal deadline is CISA asserting observed exploitation, a stronger claim than a published proof of concept, and worth saying plainly: a working PoC is not confirmed in-the-wild abuse. For Strapi the scoring bodies disagree, so that finding carries a wider band.

Actor targeting. Targeting counts only through local relevance, so a university running an exposed Strapi instance and a retailer on the same build get different weights.

Chain position. Entry points outrank support flaws. ProFTPD, Struts, and ONLYOFFICE each take an unauthenticated attacker to code execution in one step, while the BIND crash only has value to someone already inside.

The same CVE therefore lands in the top band, ACT, on an exposed instance in a named vertical, and far lower behind a management ACL. One score per CVE across every asset is what buried an eleven year old CVSS 10 in an exception queue.

Hunting this on a Tuesday afternoon

Start at the perimeter, because that half you can finish today: enumerate anything answering on 21, 80, 443, and 53 and fingerprint versions against the five products above. Then read inbound telemetry with the grouping inverted, counting distinct source addresses per destination port and path across a six hour window. On hosts the artifacts are cheap to check:

• A Debugger value under Image File Execution Options for sethc.exe, utilman.exe, osk.exe, and magnify.exe.
• UserAuthentication set to 0 on the RDP-Tcp WinStation, plus any unexpected flip of fDenyTSConnections. Microsoft recommends the Audit Registry policy.
• conhost.exe or dllhost.exe running from anywhere but its real path. Check Point tied a SoftEther binary at C:\Windows\SysWOW64\conhost.exe to this group; the real Console Window Host lives in System32.
• Sessions on 443 resolving to no known TLS destination, new virtual adapters, and Service Control Manager services starting a VPN at boot.
• certutil, bitsadmin, or PowerShell pulling an executable, weighted heavily when the parent is a web or database service. Microsoft flagged such downloads parented by SQL Server, and VPN connections from MSSQLSERVER.
• SITE CPFR and SITE CPTO pairs in ProFTPD logs, and small PHP or ASPX files in web roots calling eval on a request parameter.
• rundll32 invoking comsvcs.dll MiniDump against LSASS, and wevtutil cl clearing the Security or TerminalServices RemoteConnectionManager logs.

Fixed versions, and what patching does not do

Move ProFTPD to 1.3.5a or later, or disable mod_copy where you cannot upgrade. Struts goes to 2.3.28.1, or turn off Dynamic Method Invocation. ONLYOFFICE Document Server needs 5.6.3, Strapi 4.8.0, and BIND a release fixing TKEY handling. Anything past end of life gets no fix and belongs off the perimeter.

Where this lands for us

CVEasy AI is the number one local-first CTEM platform, and this week shows why ingestion and scoring belong in one loop: the KEV additions, the joint advisory, and the vendor research all landed inside seventy two hours, and what turns them into a ranked queue is running them through TRIS against your real inventory, on your own hardware. BASzy replays this kill chain in authorized engagements, so you learn whether an exposed ProFTPD instance is reachable before a botnet in somebody's living room learns it for you.