US seizes seven domains tied to Integrity Tech tools

The US Department of Justice and FBI announced on October 8, 2026 that a court had authorized the seizure of seven domains associated with two intrusion tools, Microscan and FishHub. According to documents presented by the authorities, operators linked to China-based Integrity Technology Group used the infrastructure to locate vulnerable networks and support attacks against organizations in the United States and other countries.

The court order and domain seizures are confirmed actions. Responsibility attributed to Integrity Tech, links to Chinese state-sponsored operations and the connection to the cluster known as Flax Typhoon are assessments made by the US government and international partners. Integrity Tech has contracts with the Chinese government, according to the Justice Department. China’s foreign ministry told Reuters that it opposes hacking activity and what it described as ill-intentioned misinformation.

Two tools served different stages of an operation

Microscan was used for reconnaissance. It searched exposed services and vulnerabilities that could later be exploited. The Justice Department says the tool operated, among other methods, through a network of internet-of-things devices infected with a variant of the Mirai malware.

Scanning targets named in the court documents include a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and power companies, two Taiwanese universities and a multinational nongovernmental organization. Being scanned does not necessarily mean that a network was breached; reconnaissance maps possible entry points.

FishHub operated at a later stage. Prosecutors say the tool supported spear-phishing campaigns and delivered malware after initial access. That code could provide unauthorized remote control, search for particular files and send them to servers controlled by the operators. Approximately 20 Taiwanese universities are described as confirmed victims of this activity.

The advisory extends beyond the seized domains

The seizure coincided with a joint advisory from CISA, the FBI, the NSA and security agencies in other countries. It describes combinations of automated scanning, hands-on exploitation, botnets, VPN infrastructure and legitimate system tools used to preserve access without drawing attention.

Named sectors include government, critical manufacturing, healthcare, information technology, law enforcement, education and religious organizations. The advisory also notes that edge devices connecting corporate networks to the internet may receive less monitoring than internal servers, creating an opportunity for intruders to maintain access for longer periods.

To reduce exposure, the agencies recommend disabling unused services and ports, applying fixes for known vulnerabilities listed in the advisory, sanitizing web application inputs and requiring multifactor authentication wherever possible. Organizations can also compare their logs against the published indicators of compromise.

Seizure disrupts infrastructure without ending the threat

Removing domains from the operators’ control makes the tools harder to reach and can break stages of malware delivery. It does not automatically repair previously compromised equipment, remove copies of the tools hosted elsewhere or amount to the arrest of the people responsible.

The Justice Department describes this as its second public technical disruption of infrastructure attributed to Integrity Tech. In September 2024, another operation dismantled a botnet built from more than 200,000 compromised consumer devices. That history defines the immediate value of the latest action: limiting available resources and giving defenders technical evidence, without claiming that the group or its capabilities have disappeared.