Some of the email these hackers stole could only be opened from IP addresses in Xiamen, the Chinese port city that faces Taiwan's Kinmen islands. They also ran a web app that let outside users call up one victim's inbox by editing a URL. Both details are in a 58-page advisory the FBI, NSA and agencies from Britain, Canada, Australia, New Zealand, Japan and Spain released on October 8. The FBI also seized two of the group's tools, MicroScan and FishHub, and officials say both are now inoperable. The advisory names the company behind it: Integrity Technology Group, a Beijing firm with links to the Chinese government whose shares trade in Shanghai. Researchers call its work Flax Typhoon. MicroScan alone held more than 1,300 scripts built to probe websites for known holes, in use since at least 2017. Officials say the tools were aimed at a U.S. power company, airports in Japan and Poland, Taiwanese universities and infrastructure firms, and an international nonprofit. Victims of the email theft included government bodies, police, health systems and religious institutions across Southeast Asia. I keep coming back to the Xiamen rule. A for-profit company doesn't wall off stolen inboxes to one city unless it knows exactly who on the other end is meant to read them. This is at least Washington's third move against the same firm in two years. The FBI disrupted its botnet of more than 200,000 devices in September 2024, and Treasury sanctioned it in January 2025. The FBI says it will keep watching for the company to rebuild. ACI — Aric Chen | Insights