U.S. Department of Justice and FBI Seize 7 Domains for Hacking Tools of Chinese Government Contractor 'Integrity Tech' With About 20 Taiwan Universities Confirmed as Victims

Photo: The large status screen at the U.S. Cyber Command Integrated Cyber Center and Joint Operations Center. This is not a facility of Integrity Tech or a screen of the seized domains. Photo source: DVIDS Photo ID 6762557, photo by Josef Cole, U.S. Cyber Command, April 2, 2021, public domain.

The U.S. Department of Justice and the Federal Bureau of Investigation (FBI) cut off the access routes to 2 types of hacking tools operated by 'Integrity Technology Group (Integrity Technology Group, hereinafter Integrity Tech),' a China-based company that has entered into contracts with the Chinese government. The number of seized Internet domains is 7. On the same day, the National Security Agency (NSA), the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and allied-country agencies issued a joint Cybersecurity Advisory (CSA) organizing the methods of hackers linked to this company.

This measure is not an announcement of charges against an individual. The basis for the domain seizures is court documents released in the U.S. District Court for the Western District of Pennsylvania, and the Department of Justice expressed the content of those documents not as confirmed fact but as 'as alleged.' The Department of Justice stated in a press release on October 8, 2026, Eastern Time in the United States (October 9, Korea time), that "through a court-authorized seizure, it prevented malicious cyber actors from accessing two hacking tools called 'Microscan' and 'FishHub.'" The Department of Justice explained that these tools "were used to scan, and in some cases hack, U.S. and foreign critical infrastructure systems." The Department of Justice stated that Integrity Tech "has entered into contracts with the government of the People's Republic of China."

The FBI Cyber Division stated on its official X account that "the FBI and the Department of Justice neutralized hacking tools used by the cyber threat group 'Flax Typhoon,'" and that they "seized several domains and blocked access to a platform used to scan and in some cases infiltrate U.S. critical infrastructure."

https://x.com/FBICyberDiv/status/2108256413084422599

What Changes

This measure is significant because it shows the U.S. government tracking Chinese hacking not only at the level of 'state hackers' but also at the level of private companies contracted with the government, and cutting off their equipment. The precedent is September 2024. The Department of Justice announced at that time that it had neutralized, under court authorization, a Mirai (Mirai) malware botnet operated by Integrity Tech. The Department of Justice stated that the botnet was composed of "more than 200,000 consumer devices in the United States and around the world." This seizure is the "second public technical neutralization" of Integrity Tech hacking infrastructure as stated by the Department of Justice.

What the Two Tools Did

According to the court documents released by the Department of Justice, Integrity Tech created and used a botnet with Internet of Things (IoT) devices infected with a Mirai variant.

• Microscan (Microscan): A reconnaissance and vulnerability scanning tool developed by Integrity Tech. The Department of Justice stated that this company's 'customers' used it to find vulnerabilities to exploit later. The scanning targets released by the Department of Justice included a U.S. electric power company in South Carolina, a multinational nongovernmental organization (NGO), airports in Japan and Poland, natural gas and electric power sector infrastructure companies in Taiwan, and 2 Taiwan universities. Integrity Tech accessed Microscan through c0cc[.]cc, one of the seized domains.
• FishHub (FishHub): A targeted phishing (spear phishing) tool. According to the Department of Justice, after initial infiltration it caused additional malware to be downloaded, and this malware opened remote unauthorized access or found specific files and sent them to a server controlled by Integrity Tech. The confirmed victims stated by the Department of Justice included "about 20 Taiwan universities." Among the seized domains, 5 (98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net) were used to distribute this malware.

A press release from the U.S. Attorney's Office for the Western District of Pennsylvania stated that the remaining 1 domain was connected to unauthorized remote management software that connected victim networks to Integrity Tech servers.

The FBI San Diego Field Office announced on its X account that it led this investigation.

https://x.com/FBISanDiego/status/2108252514365653376

NSA Advisory: "Wide Range of Victim Sectors"

The NSA stated in a press release on the same day that the title of the joint advisory was "Chinese Government-Linked Cyber Threat Actors Combine Automated and Manual Hacking Tools to Steal Sensitive Data." The NSA explained, quoting the advisory, that Integrity Tech "enabled Chinese government-linked threat actors to exploit the networks of U.S. and foreign organizations in several sectors, including government services and facilities, critical manufacturing, health care and public health, and information technology." The NSA stated that the targets also included U.S. law enforcement agencies, educational institutions, and religious organizations, as well as organizations in Southeast Asia, Africa, and North America.

The NSA Cyber official account also posted that "Integrity Tech enabled Chinese government-linked threat actors to exploit networks of organizations around the world and exfiltrate critical data." CISA also announced on its X account that it had issued the advisory together with the FBI.

https://x.com/NSACyber/status/2108259285318635667 https://x.com/CISAgov/status/2108251840802365869

Regarding the designation, the NSA stated that some of these were consistent with methods called in the industry 'Flax Typhoon,' 'Storm 919,' 'Ethereal Panda,' and 'Red Juliet.' These are names given by the private security industry, and the U.S. government limited the scope to "some."

What the Authorities Said

John Eisenberg, Assistant Attorney General for National Security at the Department of Justice, said, "the United States will not leave China or its proxies to act in cyberspace against U.S. interests without any punishment." The Department of Justice National Security Division also posted this statement on its official X account.

Troy Rivetti (Troy Rivetti), U.S. Attorney for the Western District of Pennsylvania, said, "this seizure is the second in 2 years to neutralize a large-scale operation of Integrity Tech." Brett Leatherman (Brett Leatherman), Assistant Director of the FBI Cyber Division, said, "China relies on contractors and support companies to broaden the scope and scale of its malicious cyber activity," and that "by exposing and neutralizing such enablers, we make it more difficult for China to target U.S. networks and infrastructure."

The Attack Sequence Stated in Joint Advisory AA26-281A

The formal identification number of the joint Cybersecurity Advisory released on the same day is AA26-281A. The authoring agencies are the FBI, CISA, and NSA, joined in an international joint name by the United Kingdom National Cyber Security Centre (NCSC-UK), the Australian Signals Directorate's Australian Cyber Security Centre (ASD ACSC), the Canadian Centre for Cyber Security, Japan's National Police Agency and National Cybersecurity Office, the New Zealand National Cyber Security Centre, and Spain's National Intelligence Centre (CNI). The advisory states that the starting point of the analysis is technical evidence secured and observed by the FBI in multiple investigations related to Integrity Tech. If the Department of Justice domain seizure is a measure on the criminal and court procedure side, this advisory corresponds to a technical document distributing indicators of compromise and methods from the same investigation to defenders.

The reconnaissance stage organized in the advisory is more specific than the Department of Justice press release. It states that the attackers used public scanning tools such as BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan to find vulnerabilities in networks and web applications. The ports mainly examined are 21 (FTP), 22 (SSH), 53 (DNS), 80 (HTTP), 443 (HTTPS), and 1080 (SOCKS). Regarding Microscan, the advisory states that it had been used since around 2017, and that inside a Python-based web application there were more than 1,300 penetration testing scripts to find specific vulnerabilities. The services targeted by the scripts included OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.

The initial infiltration and persistence methods are also stated step by step. The advisory stated that the FBI recovered a payload with which the attackers, through a cross-site scripting (XSS) attack using JavaScript and HTML, displayed username and password input fields to steal credentials. Another tool, EBurst, was stated to perform password spraying and password guessing against Microsoft Exchange servers, and to use ten interfaces as attack paths, including the Exchange Control Panel (ECP), Exchange Web Services (EWS), Offline Address Book (OAB), and Outlook Web Access (OWA). After infiltration, the advisory's analysis states that they downloaded an installation file for SoftEther, normal VPN software, to the victim device, set it to automatically reconnect at start, and changed the file name to a common Windows executable file name such as conhost.exe or dllhost.exe to try to avoid detection.

At the data collection stage, the advisory explains that a file called DC.exe executed the Active Directory (AD) replication technique DCSync to copy account credentials, group composition, and trust relationship information. A PHP script, Curlc4.txt, was stated to access the Microsoft EWS API to bring in content such as email, calendars, and contacts, and after compressing it or encrypting it with RC4 or AES-128-CBC, to upload it to a remote server. A command-line tool called office-cli was used to repeatedly access Outlook365 accounts and extract email by period. The advisory also states that confirmed cases of email data theft included government organizations, law enforcement agencies, medical systems, and religious institutions in Southeast Asia, and that in some cases access to the extracted data was restricted to only an IP address from Xiamen, China. This detailed method supplements the Department of Justice press release's explanation of 'FishHub,' but the confirmed victim scale of about 20 Taiwan universities must not be expanded and read as all cases in the advisory.

Items Recommended for Defenders to Check Immediately

The advisory's defense guidance does not stop at a general call for attention. The authoring agencies recommend turning off unused services and ports, and minimizing the information that login pages and banners expose to external requests. Items were also specified to prevent XSS payload injection through web application input value validation, and to apply multi-factor authentication (MFA) to all services, centered on webmail, VPN, and critical system access accounts. Guidance to change default passwords to strong passwords, to restrict and audit administrator-privilege accounts and apply the principle of least privilege, and to turn on the browser's download and domain reputation checks and protective DNS, was also stated together.

In the patch items, eight vulnerabilities confirmed as actually successfully exploited cases were presented in a table. They are CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894. The advisory indicates that some of these are items newly added to CISA's 'Known Exploited Vulnerabilities (KEV)' list. On the detection side, it stated to monitor for signs of unauthorized use of 'living-off-the-land' techniques that exploit normal system tools, unexpected AD replication, abnormal scanning and upload traffic, logins outside working hours, and physically impossible simultaneous access. In the recovery plan, items were included to keep multiple copies of sensitive data and server copies in a physically separated and secured place, and to put a password on offline backup copies.

The sequence for when compromise is suspected is also stated in the advisory. The flow is to isolate or take offline a host confirmed to be infected, collect logs and artifacts to specify the attacker's methods, scope of infection, and timeline of activity, report in accordance with country-specific guidance, and apply eviction measures to strengthen the network. As reporting channels for U.S. organizations, the FBI Internet Crime Complaint Center (IC3), the competent FBI field office, and the CISA 24-hour operations center (contact@cisa.dhs.gov, 1-844-Say-CISA) were presented. The NSA cybersecurity guidance inquiry address is CybersecurityReports@nsa.gov.

Differences Between the 2024 Botnet Neutralization and This Seizure

On September 18, 2024, the Department of Justice announced that, through a court-authorized operation, it had neutralized a botnet of more than 200,000 consumer devices in the United States and around the world. The infected devices at that time were small office and home office (SOHO) routers, IP cameras, digital video recorders (DVR), and network attached storage (NAS). The Department of Justice stated that Integrity Tech controlled infected devices with an online application branded 'KRLab,' and in it provided a malicious command menu with a tool called 'vulnerability-arsenal.' The court-authorized operation was a method of taking over the hackers' infrastructure and then, through that infrastructure, sending a deactivation command to the malware on infected devices, and the Department of Justice stated that during the operation there was an attempted distributed denial-of-service (DDoS) disruption targeting the FBI's recovery base, but it failed.

This 2026 measure is a follow-up to that, but rather than the method being the same, the target was narrowed. In 2024, sending a command to the infected consumer devices themselves to cut the botnet connection was at the center, and the FBI went through prior testing so that the command would not harm the normal functions of the devices and would not collect content information, and stated that it would notify device owners in the United States through Internet service providers. In 2026, the focus was placed on seizing 7 tool access routes, including 1 Microscan access domain, 5 FishHub-related domains, and 1 remote management connection domain. The Department of Justice stated that the prosecutors handling the prosecution are Assistant U.S. Attorney Brendan McKenna of the U.S. Attorney's Office for the Western District of Pennsylvania and Trial Attorney Jack Singer-Emery of the National Security Cyber Section of the Department of Justice National Security Division, and that Assistant U.S. Attorney Thomas Sullivan of the U.S. Attorney's Office for the District of Maryland and Japan's National Police Agency provided substantial support. Mark Remily, Special Agent in Charge of the FBI San Diego Field Office, also issued a statement that he would "mobilize all investigative authorities together with law enforcement partners," which is the position of the field office chief stated in the U.S. Attorney's Office and headquarters press releases, separately from the statements of U.S. Attorney Rivetti and Assistant Director Leatherman quoted in the front part of the body.

China and Taiwan, and Korea

The Department of Justice and NSA materials do not contain a reaction from the Chinese government or Integrity Tech. Korean institutions are not included in the target and victim list released by the Department of Justice. However, Japan's National Police Agency was named in the Department of Justice press release as an agency that gave "substantial assistance" to the investigation, and a Japanese airport was included among the scanning targets.

Next Steps

The Department of Justice released an FBI affidavit (affidavit) and a seizure warrant. The investigation is handled by the FBI San Diego and Baltimore Field Offices and the FBI Cyber Division, and the prosecution is handled by the U.S. Attorney's Office for the Western District of Pennsylvania and the National Security Cyber Section of the Department of Justice National Security Division. The Department of Justice did not state an individual indictment in this announcement. Network administrators can conduct their own checks by comparing the indicators of compromise (IoC) in the joint advisory.

Sources

U.S. Department of Justice Office of Public Affairs press release, October 8, 2026: https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated U.S. Department of Justice, U.S. Attorney's Office for the Western District of Pennsylvania press release, October 8, 2026: https://www.justice.gov/usao-wdpa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools U.S. National Security Agency press release, October 8, 2026: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4622576/nsa-joins-fbi-and-others-to-provide-guidance-to-mitigate-chinese-government-lin/ CISA, FBI, NSA and others joint Cybersecurity Advisory AA26-281A, October 8, 2026: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a U.S. Department of Justice Office of Public Affairs press release, September 18, 2024 (Integrity Tech botnet neutralization): https://www.justice.gov/archives/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state