12 OCT 2026 — The FBI has seized seven internet domains that a Chinese government contractor used to run two hacking tools, one for scanning networks for weaknesses and one for breaking in through phishing. The US Justice Department said on 8 October that the tools were used against power, gas and airport operators in the United States, Taiwan, Japan and Poland, and that about 20 Taiwanese universities were confirmed victims.
The contractor is Integrity Technology Group, a China-based company with Chinese government contracts. US agencies link it to the hacking activity security firms call Flax Typhoon.
Two tools, seven domains
According to the Justice Department, the first tool, MicroScan, was built by Integrity Tech to scan networks for vulnerabilities its clients would later exploit. It worked partly through a botnet of internet-connected devices infected with a variant of the Mirai malware. Integrity Tech reached it through one of the seized domains.
The second, FishHub, was used for spear-phishing. After a first compromise, it downloaded more malware that gave clients remote access or searched for specific files and sent them to Integrity Tech's servers. Five of the seized domains delivered that malware.
The targets of MicroScan scanning included a power company in South Carolina, an international non-governmental organisation, Japanese and Polish airports, Taiwanese natural gas and power companies, and two Taiwanese universities. FishHub's confirmed victims included about 20 Taiwanese universities.
A contractor, not a unit
US officials stressed the business model. "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity," said Brett Leatherman, assistant director of the FBI's Cyber Division.
The second takedown in two years
It was the second public technical disruption of Integrity Tech's infrastructure, according to the Justice Department. In September 2024 the department disrupted the company's Mirai botnet of more than 200,000 consumer devices. Japan's National Police Agency gave "substantial assistance" to the latest case, which is being prosecuted in the Western District of Pennsylvania.
What the advisory adds
Alongside the seizures, ten agencies from the United States, the United Kingdom, Australia, Canada, Japan, New Zealand and Spain published joint advisory AA26-281A. It says the actors Integrity Tech enables targeted US government, manufacturing, healthcare and technology organisations, as well as "organizations across Southeast Asia, Africa, and North America".
They combine open-source scanning tools with MicroScan, which the advisory says has been used since at least 2017 and holds more than 1,300 scripts aimed at software such as Oracle WebLogic, Jenkins, Apache Struts and Juniper ScreenOS. Other techniques include cross-site scripting that fakes a login prompt to harvest passwords, and password spraying against Microsoft Exchange and Office 365 accounts. The advisory lists eight vulnerabilities, identified by CVE number, the oldest from 2014.
What defenders should do
Defenders should switch off unused services and ports, sanitise web application input against cross-site scripting, and require multifactor authentication wherever possible, the advisory says. It publishes indicators of compromise in machine-readable form for organisations to hunt with.
The age of the listed flaws is the practical lesson. An operation backed by a state contractor still found its way in through bugs patched years ago and through accounts protected only by a password.
View author profile → · Editorial policy
