U.S. Seizes Domains Behind Chinese Firm's Hacking Tools in Second Disruption of Integrity Tech

The Justice Department and FBI on Thursday announced court-authorized seizures of internet domains meant to deny hackers access to two tools, Microscan and FishHub, that the department says were used to scan and, in some cases, break into critical infrastructure systems and other networks in the United States and abroad.

Court documents unsealed in the Western District of Pennsylvania allege that hackers working for Integrity Technology Group, a company based in China that has contracts with the Chinese government, operated and used both tools.

The filings say Integrity Tech created and used a botnet of internet-connected devices infected with a variant of the Mirai malware, and that the botnet helped it run Microscan, a tool the company developed to probe victim networks for weaknesses that its clients would later exploit. The department said Microscan's scanning targets included a South Carolina power company, a multinational nongovernmental organization, airports in Japan and Poland, Taiwanese natural gas and power companies, and two universities in Taiwan.

FishHub, according to the department, helped hackers break into networks through spear-phishing and then downloaded more malware that gave Integrity Tech's clients unauthorized remote access or searched for specific files and sent them to servers the company controlled. Confirmed FishHub victims included about 20 Taiwanese universities. The department identified one seized domain that Integrity Tech used to reach Microscan and five that delivered FishHub's malware.

The Associated Press reported that the operation left both tools inoperable, a result FBI and Justice Department officials called a blow to the hacking campaign. Jason Bilnoski, a deputy assistant director of the FBI's Cyber Division, told the AP that the bureau aims to take capabilities away from such hackers by targeting "their infrastructure, their money, and their tools." He called the hacking operation "indiscriminate and reckless."

"The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace," said John A. Eisenberg, the assistant attorney general for national security.

The seizures are the department's second public technical disruption of Integrity Tech's hacking infrastructure. In September 2024, it announced a court-authorized operation against the company's Mirai botnet, which the department said consisted of more than 200,000 consumer devices in the United States and worldwide.

Alongside the seizures, the FBI and other U.S. and foreign agencies published a cybersecurity advisory with indicators that network defenders can use to detect Integrity Tech intrusions. Britain's National Cyber Security Centre, part of GCHQ, said it co-sealed the advisory with agencies from Australia, Canada, Japan, New Zealand, Spain and the United States. The British agency said hackers enabled by the company are pairing scanning tools and large botnets with hands-on exploitation to compromise networks and steal confidential data from companies around the world, including in critical sectors. It said the activity is consistent with campaigns publicly known as Flax Typhoon, Ethereal Panda and Red Juliett, among others.

"The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity," said Brett Leatherman, assistant director of the FBI's Cyber Division.

Washington and London had already sanctioned the company. The Treasury Department acted in January 2025, citing alleged hacks of U.S. victims that included incidents attributed to Flax Typhoon, and the NCSC said the British government imposed its own sanctions last year. Integrity Tech rejected the U.S. sanctions at the time, saying the move had "no factual basis" and telling the Shanghai Stock Exchange that it "firmly opposes" the Treasury Department's "unwarranted accusations." A spokesperson for China's foreign ministry, Guo Jiakun, said Washington was using the issue to "defame and smear China," the Associated Press reported.

The department described the company's role as allegations contained in court documents, and its announcement did not say whether anyone has been charged. The FBI's San Diego and Baltimore field offices are investigating, and the department credited Japan's National Police Agency with substantial assistance. Brett Lally, a supervisory special agent in the San Diego office, said the department would keep monitoring for any effort by the company to rebuild its infrastructure.