The U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have announced court-authorized seizures of two hacking tools, Microscan and FishHub, allegedly operated by malicious cyber actors working for Integrity Technology Group (Integrity Tech), a company based in the People’s Republic of China (PRC) with contracts with the PRC government. According to court documents unsealed in the Western District of Pennsylvania, the tools were used to scan computer networks for vulnerabilities and, in some cases, facilitate cyber intrusions targeting U.S. and foreign critical infrastructure. The affected targets included a South Carolina-based power company, airports in Japan and Poland, Taiwanese energy infrastructure companies, and universities. The operation marks the Justice Department’s second public technical disruption of Integrity Tech’s hacking infrastructure.
Key Details of the Cybersecurity Enforcement Action
| Case detail | Information |
|---|---|
| Lead agencies | U.S. Department of Justice and FBI |
| Company involved | Integrity Technology Group (Integrity Tech) |
| Country of origin | People’s Republic of China (PRC) |
| Hacking tools seized | Microscan and FishHub |
| Primary targets | U.S. and foreign critical infrastructure and computer networks |
| Vulnerability-scanning tool | Microscan |
| Spear-phishing and intrusion tool | FishHub |
| Malware associated with the operation | Mirai malware variant and additional malware |
| Confirmed FishHub victims | Approximately 20 Taiwanese universities |
| Earlier disruption | September 2024 court-authorized disruption of an Integrity Tech Mirai botnet |
| Investigating offices | FBI San Diego and Baltimore Field Offices, coordinated with the FBI Cyber Division |
| Court jurisdiction | Western District of Pennsylvania |
What Are Microscan and FishHub?
Microscan: A Tool for Network Reconnaissance
According to court documents, Integrity Tech developed Microscan to conduct reconnaissance of computer networks and identify vulnerabilities that its clients could subsequently exploit. The tool allegedly performed vulnerability scanning through a botnet and other methods.
Investigators said Integrity Tech accessed Microscan through one of the seized domains, c0cc[.]cc. The scanning activity targeted networks across multiple countries and sectors, including critical infrastructure, transportation, and nonprofit organizations.
Targets identified in the court documents included:
- A U.S. power company based in South Carolina.
- A multinational nongovernmental organization.
- Airports in Japan and Poland.
- Taiwanese companies operating in the natural gas and electricity sectors.
- Two Taiwanese universities.
The allegations indicate that the scanning activity was intended to identify weaknesses that could enable subsequent exploitation.
Approval Phishing Scam Crisis: $4 Billion in Global Losses and Operation Spincaster’s Response
FishHub: A Tool Used in Spear-Phishing Operations
FishHub was allegedly used to facilitate unauthorized access to computer networks through spear-phishing attacks. After an initial network compromise, the tool downloaded additional malware onto the victim’s systems.
According to the Justice Department, this malware enabled Integrity Tech’s clients to obtain unauthorized remote access to compromised networks or search for specific files and transmit them to servers controlled by Integrity Tech.
Investigators identified approximately 20 Taiwanese universities as confirmed victims of FishHub activity. The alleged operations illustrate how phishing-based compromises can progress into persistent network access and potential data theft.
Domains Seized by the Justice Department and FBI
Infrastructure Used to Deliver Malware
The Justice Department and FBI seized domains associated with the hacking tools to disrupt their operation and prevent malicious cyber actors from continuing to use them.
Five of the seized domains allegedly helped deliver malware associated with FishHub:
98aicai[.]com98aicode[.]comoutlook3650[.]comyoutubecard[.]comlinkedinns[.]net
The court-authorized action also targeted the infrastructure used to access Microscan. By disrupting these domains and associated tools, investigators sought to deny the operators access to capabilities used for reconnaissance, phishing, and unauthorized network access.
Integrity Tech’s Alleged Botnet and China-Linked Cyber Operations
Mirai Malware and Internet-of-Things Devices
Court documents allege that Integrity Tech created and operated a botnet comprising internet-of-things (IoT) devices infected with a variant of Mirai malware. The botnet facilitated vulnerability scanning through Microscan, among other activities.
Mirai is malware associated with the compromise of connected devices to create networks that can be remotely controlled. In this case, the alleged botnet provided infrastructure for scanning victim networks and supporting broader cyber operations.
The DOJ stated that Integrity Tech has contracts with the PRC government and that China-linked threat actors used capabilities provided by the company to conduct widespread vulnerability scanning and, in some cases, intrusions against U.S. and foreign critical infrastructure.
Alleged Role of Contractor and Enabling Companies
Assistant Director Brett Leatherman of the FBI’s Cyber Division said Integrity Tech provided China-linked threat actors with capabilities used to identify vulnerabilities and intrude into networks.
The FBI also emphasized that the PRC relies on contractors and enabling companies to expand the reach and scale of malicious cyber activity. Disrupting these supporting organizations, according to the agency, makes it more difficult for threat actors to target American networks and infrastructure.
These allegations form part of the U.S. government’s efforts to identify and disrupt the technical infrastructure supporting state-linked cyber operations.
DOJ Seizes More Than 1,000 Domains Streaming FIFA World Cup 2026 Matches Illegally
DOJ and FBI Officials Respond to the Seizures
Justice Department’s National Security Division
Assistant Attorney General for National Security John A. Eisenberg said the United States would not allow China or its proxies to operate against U.S. interests in cyberspace without consequences. He emphasized the National Security Division’s commitment to disrupting the Flax Typhoon threat, dismantling supporting infrastructure, and protecting critical networks.
The department characterized the operation as part of its broader response to cyber threats affecting national security and essential services.
U.S. Attorney’s Office for the Western District of Pennsylvania
U.S. Attorney Troy Rivetti said state-sponsored hackers continued to target networks and systems worldwide to identify and steal files and exploit vulnerabilities.
He described the seizures as the department’s second disruption of Integrity Tech’s extensive operations in as many years, emphasizing the government’s commitment to cybersecurity in the United States and abroad.
FBI Cyber Division and FBI San Diego
FBI Cyber Division Assistant Director Brett Leatherman highlighted the role of China-linked threat actors and the companies that enable their operations. He said exposing and disrupting those organizations helps restrict their ability to target American infrastructure.
Special Agent in Charge Mark Remily of the FBI San Diego Field Office also emphasized the agency’s commitment to disrupting PRC state-sponsored cybercriminals and protecting critical infrastructure. He said FBI San Diego and its international law enforcement partners would continue using their investigative authorities to safeguard networks and the American public.
Previous Disruption of Integrity Tech’s Hacking Infrastructure
September 2024 Mirai Botnet Operation
The current action marks the Justice Department’s second public technical disruption of Integrity Tech’s hacking infrastructure.
In September 2024, the department announced a court-authorized disruption of an Integrity Tech Mirai malware botnet consisting of more than 200,000 consumer devices in the United States and worldwide.
The latest seizures build on that earlier operation by targeting the Microscan and FishHub tools and associated domains allegedly used for network reconnaissance, malware delivery, and intrusions.
The two actions demonstrate continued efforts to disrupt the technical resources associated with the company’s alleged cyber activities.
Cybersecurity Advisory and Network Defense Measures
Indicators of Compromise Published
Alongside the seizures, the FBI and partner agencies in the United States and other countries published a cybersecurity advisory containing indicators of compromise associated with Integrity Tech’s intrusion activity.
The advisory is intended to help network defenders identify and respond to malicious activity linked to the alleged operations.
Organizations responsible for critical infrastructure and other potentially affected networks can use such indicators to support the identification of suspicious activity and strengthen incident response efforts.
The advisory complements the court-authorized seizures by providing technical information intended to help defenders detect and address threats associated with Integrity Tech.
Amachukwu charged in $8 million hacking and wire fraud scheme
Investigation and Prosecution Details
FBI Field Offices and International Cooperation
The FBI San Diego and Baltimore Field Offices are investigating the case in coordination with the FBI Cyber Division.
The Justice Department also acknowledged substantial assistance from Assistant U.S. Attorney Thomas Sullivan for the District of Maryland and Japan’s National Police Agency.
The involvement of domestic and international partners reflects the cross-border nature of the alleged cyber operations and the need for cooperation when investigating threats affecting networks in multiple countries.
Prosecutors Handling the Case
The case is being prosecuted by Attorney Brendan McKenna for the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery of the National Security Division’s National Security Cyber Section.
The proceedings relate to allegations described in court documents unsealed in the Western District of Pennsylvania. The seizures are intended to disrupt the infrastructure used by the alleged operators and prevent continued access to the hacking tools.
Conclusion
The DOJ and FBI’s court-authorized seizure of Microscan and FishHub represents a significant disruption of hacking infrastructure allegedly operated by Integrity Technology Group, a China-based company with contracts with the PRC government. The tools were allegedly used to scan networks for vulnerabilities, facilitate spear-phishing attacks, deploy additional malware, and enable unauthorized access to computer systems.
The operation follows the September 2024 disruption of an Integrity Tech-linked Mirai botnet involving more than 200,000 consumer devices worldwide. Through domain seizures, international law enforcement cooperation, and the publication of indicators of compromise, U.S. authorities are seeking to reduce the threat posed by China-linked cyber operations against critical infrastructure and other networks.
To read the original order please visit DOJ (Department of Justice) website.