Clarissa Hana
The Federal Bureau of Investigation (FBI) has announced the successful seizure of seven internet domains that served as critical infrastructure for Chinese state-sponsored hacking operations. These domains were integral to the functioning of two sophisticated hacking tools, MicroScan and FishHub, allegedly operated by a China-based entity known as Integrity Technology Group (Integrity Tech). U.S. authorities assert that Integrity Tech maintains contractual ties with the Chinese government, enabling these tools to conduct widespread vulnerability scanning and unauthorized intrusions targeting critical infrastructure and various organizations across the globe.
The operation, detailed by the U.S. Department of Justice, represents a significant step in the ongoing efforts to counter cyber threats emanating from state-sponsored actors. Assistant Director of the FBI’s Cyber Division, Brett Leatherman, emphasized the strategic importance of disrupting such operations. "Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure," Leatherman stated. He further elaborated on the Chinese government’s modus operandi, noting their reliance on contractors and intermediary companies to extend the reach of their cyber activities, thereby making attribution more complex. The disruption of these entities, he concluded, directly hinders the ability of China-linked hackers to target American networks.
Unmasking the Tools: MicroScan and FishHub
MicroScan: The Vulnerability Scanner
At the heart of the FBI’s action lies the disruption of the MicroScan platform, a custom-built vulnerability scanning tool developed by Integrity Tech. This platform was designed to systematically identify exploitable security weaknesses within targeted networks. According to an FBI seizure affidavit, MicroScan was frequently employed in conjunction with a botnet comprising internet-connected devices infected with the Mirai malware. This combined approach allowed the hackers to conduct extensive scanning operations, probing for potential entry points into a wide array of sensitive systems.
The scope of targets identified through MicroScan is extensive and concerning. The affidavit reveals that this scanning activity encompassed critical infrastructure sectors, including a power company in South Carolina, airports in Japan and Poland, and major energy providers in Taiwan, such as natural gas and electricity companies. Educational institutions were also heavily targeted, with universities in Taiwan specifically mentioned as having their networks scanned by MicroScan in August 2022 and March 2023, leading to subsequent confirmed breaches. While the FBI has confirmed that the hacking tools were utilized in intrusions involving critical infrastructure, the specific status of breaches at the named power companies, airports, and energy providers remains undisclosed.
The FBI seized the domain c0cc.cc, which served as a crucial access point for Integrity Tech to manage and operate the MicroScan platform. Law enforcement confirmed that this domain was active and accessible as of September 2026.
FishHub: The Spear-Phishing and Exfiltration Engine
Complementing MicroScan’s reconnaissance capabilities, the FishHub platform was employed to execute more targeted and intrusive attacks. FishHub was primarily used to conduct spear-phishing campaigns, a sophisticated form of social engineering designed to trick individuals into revealing sensitive information or downloading malicious software. Once a network was compromised, FishHub facilitated the delivery of additional malware, granting attackers unauthorized remote access.
This remote access allowed the threat actors to navigate the victim’s network, search for specific files of interest, and exfiltrate sensitive data to servers controlled by Integrity Tech. The scale of data theft facilitated by FishHub is significant. The FBI seizure affidavit indicates that investigators discovered data and files belonging to over 20 distinct organizations on a server linked to the FishHub data-theft tool. Among these victims were six universities in Taiwan, underscoring the broad reach of this operation.
To support FishHub’s operations, law enforcement seized five domains: 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, and linkedinns.net. These domains were instrumental in delivering the malicious payloads and maintaining communication channels for data exfiltration.
A seventh domain, 98aiblog.com, was also seized and found to be connected to the deployment of SoftEther VPN software on compromised systems. This software was used by the attackers to establish and maintain persistent remote access to victim networks, allowing for continued surveillance and data extraction.
Following the seizures, the affected domains now display FBI notices, clearly identifying the Flax Typhoon hacking group and Integrity Technology Group as the entities behind the malicious activities.
A Coordinated Global Response
The domain seizures were not an isolated action but part of a broader, coordinated international effort. In conjunction with the FBI’s operation, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and various international partners jointly issued a cybersecurity advisory. This advisory provided a comprehensive overview of how Chinese government-linked hackers leveraged Integrity Tech’s tools and infrastructure to compromise organizations and pilfer sensitive information.
The advisory highlighted the diverse range of targeted sectors, including U.S. government agencies, critical manufacturing, healthcare, information technology, law enforcement, educational institutions, and religious organizations. Geographically, the attacks spanned the United States, Southeast Asia, Africa, and North America. The activities described in the advisory align with previously tracked operations under names such as Flax Typhoon, Ethereal Panda, and Red Juliett, although the agencies acknowledge that not all activity may be directly attributable to Integrity Tech.
Deep Dive into the Attack Methodology
The joint advisory offered granular details about the sophistication of the tools and techniques employed by the attackers.
MicroScan’s Technical Underpinnings:
MicroScan, identified as a Python-based vulnerability scanner, is reported to contain an extensive library of over 1,300 penetration-testing scripts. These scripts are designed to probe for security flaws in a wide array of widely used software applications. Commonly targeted vulnerabilities were associated with popular platforms such as Oracle WebLogic, Apache Struts, WordPress, Jenkins, and other critical web services.
Exploited Vulnerabilities:
While the advisory did not list all eight commonly targeted vulnerabilities, the focus on established and widely deployed software indicates a strategy of exploiting known weaknesses that may not have been patched promptly by organizations. This underscores the persistent threat posed by unpatched software and the importance of robust vulnerability management programs.
Beyond Scanning: Data Theft and Persistence:
The attackers’ methodology extended beyond mere vulnerability identification. They also utilized the open-source EBurst tool to conduct password-spraying attacks, specifically targeting Microsoft Exchange servers. This technique involves systematically trying common passwords against a large number of accounts, often leading to successful compromises.
Further tools were employed to facilitate the theft of emails, the collection of Active Directory credentials (which grant extensive access to network resources), and the exfiltration of sensitive data. The FBI’s discovery of a custom web application that allowed third parties to browse stolen emails without direct account access points to a sophisticated staging and data management capability by the attackers.
Indicators of Compromise and Mitigation Strategies:
To assist organizations in defending themselves, the joint advisory includes crucial indicators of compromise (IoCs). These IoCs encompass IP addresses, domains, malware hashes, and detailed information about the attackers’ tools and tactics. This intelligence is vital for security teams to identify potential intrusions and to implement effective defensive measures.
Authorities are strongly urging organizations to:
- Review Indicators of Compromise: Proactively scan networks for any signs of the identified IoCs.
- Patch Vulnerable Systems: Prioritize patching known vulnerabilities in software, especially those targeted by the attackers.
- Disable Unnecessary Exposed Services: Reduce the attack surface by disabling any services that are not essential and are accessible from the internet.
- Enforce Multifactor Authentication (MFA): Implement MFA for all user accounts, particularly for privileged accounts, as it significantly enhances security against credential-based attacks.
A Pattern of Disruption Against Integrity Tech
This recent action against Integrity Tech is not an isolated incident; it represents a continued effort by U.S. law enforcement and international partners to dismantle the cyber-espionage infrastructure attributed to the company.
Previous Botnet Disruption:
In September 2024, the U.S. Department of Justice successfully disrupted a Mirai botnet operated by Integrity Tech. This botnet consisted of over 260,000 compromised consumer devices, including routers and IP cameras, deployed globally. The exploitation of Internet of Things (IoT) devices for botnet operations remains a significant cybersecurity challenge.
International Sanctions:
The actions against Integrity Tech have also drawn international condemnation and sanctions. In 2025, the United Kingdom government sanctioned Integrity Tech, citing its involvement in "reckless and irresponsible activity in cyberspace." Subsequently, in 2026, the European Union also imposed sanctions on the company for its role in cyberattacks targeting Europe and its allies. These coordinated sanctions underscore the global consensus on the threat posed by state-sponsored cyber operations and the companies that facilitate them.
The seizure of these domains and the accompanying advisories represent a significant blow to the operational capabilities of Flax Typhoon and its alleged facilitators. However, the persistent nature of state-sponsored cyber threats means that vigilance, continuous security improvements, and international cooperation will remain paramount in safeguarding critical infrastructure and sensitive data. The ongoing cat-and-mouse game between cyber defenders and sophisticated threat actors necessitates a proactive and adaptive approach to cybersecurity.
