The FBI has seized seven domains that Flax Typhoon, a Chinese state-sponsored group, used to run two tools called MicroScan and FishHub. Both were used in attacks that breached critical infrastructure, according to BleepingComputer's account of the seizure.

The Record reports that the US and other nations also took down infrastructure belonging to Integrity Tech, a Beijing-based company. The infrastructure allowed what the coalition described as "widespread vulnerability scanning and, in some cases, intrusions."

Read that sentence again. Vulnerability scanning is a product category. The company behind the tools, according to the coalition, ran it against other people's networks.

A separate FBI notice, reported by The Hacker News, concerns hackers tied to a Chinese cybersecurity company. It says they stole email from government organisations, law enforcement agencies, healthcare systems and religious institutions in Southeast Asia, and ran a portal selling access to the stolen mail. A mailbox stops being a breach and becomes inventory. The people in it did not consent to being listed.

CISA published its own advisory, aa26-281a, titled "Chinese State Hackers Blend Automated and Hands-On Tools to Steal Data." The title describes the working method. Scanners find the door. A person walks through it.

That ordering is visible in our own feed. Four flaws on our tracked list entered CISA's Known Exploited Vulnerabilities catalogue in the seven days to 9 October, among them the FortiMail path traversal (CVE-2026-104286) and the Cisco Catalyst SD-WAN Manager bypass (CVE-2026-76504). Both are internet-facing management or mail systems, the kind of box a scanner reaches before anyone has read the advisory.

Seizing seven domains cuts the scanner's reporting path. It does not patch the Cisco device or the FortiMail gateway. Whoever already holds scan results can still read them.

The control that changes the outcome sits on the defender's side of the glass. An internet-facing management interface, restricted to an allow-listed address range, returns nothing to a scanner that arrives from outside it. A patch window is optional for the scanner. An access list is not.