Seven domains seized after FBI halts China-linked intrusion platforms

The FBI took control of seven domains, the web addresses the tools needed to work, and replaced them with seizure notices naming Integrity Tech and the hacking group known as Flax Typhoon. Court documents behind the operation were unsealed in the Western District of Pennsylvania.

The seven domains break down like this:

• One for MicroScan: the address Integrity Tech used to log in to the scanning platform, which investigators confirmed was still online in September 2026.
• Five for FishHub: addresses used to deliver malware to victims, several of them dressed up to look like familiar brands.
• One for remote access: a domain tied to SoftEther VPN software that attackers installed on hacked machines to keep a way back in.

Brett Leatherman, assistant director of the FBI’s Cyber Division, said Integrity Tech gave China-linked hackers the ability to run broad vulnerability scans and, in some cases, break into critical infrastructure in the US and abroad. He said Beijing leans on contractors like this to widen its reach, so knocking them out makes it harder to target American networks.

MicroScan was the scouting tool. Written in Python, it held more than 1,300 penetration-testing scripts, small programs that each probe for one known weakness, aimed at popular software such as Jenkins, Oracle WebLogic, Juniper ScreenOS and Apache Struts. The allies’ advisory says it has been in use since 2017, and the FBI says it was paired with a botnet of devices infected with Mirai malware to sweep potential targets.

FishHub handled the next step. It ran spear-phishing campaigns, emails tailored to a specific person, and pushed extra malware onto networks that were already compromised. That malware let attackers search for particular files and copy them to servers Integrity Tech controlled. On one FishHub-linked server, investigators found data from more than 20 organizations, including six Taiwanese universities.

The scan list read like a map of essential services. According to the FBI affidavit, targets included a power company in South Carolina, airports in Poland and Japan, Taiwanese gas and electricity firms, and universities.

Scanning didn’t always lead to a break-in, and the FBI hasn’t said whether the named power company, airports or energy firms were actually breached. But it did confirm that two Taiwanese universities scanned with MicroScan, in August 2022 and March 2023, were later compromised.

The wider campaign reached US government agencies, critical manufacturing, healthcare, IT and law enforcement, along with schools and religious groups, plus organizations in Africa, North America and Southeast Asia. Investigators also found a custom web app that let outsiders read stolen email without logging into the hacked accounts, and in some cases access was limited to internet addresses in Xiamen, China.

The advisory was not a US-only document. The FBI, CISA and the NSA published it with Australia’s cyber agency and partners from Canada, Spain, New Zealand, Japan and the UK.

Paul Chichester, director of operations at the UK’s National Cyber Security Centre, said the range of sectors hit worldwide shows the scale of the threat and that every organization should take note. Australia’s signals agency said it wasn’t named as a victim location but that the same flaws and techniques apply there.

This was also not the first strike against Integrity Tech. In September 2024, a court-approved US operation took down a Mirai botnet the company ran, made up of more than 200,000 hacked consumer devices. The US Treasury sanctioned the firm in January 2025, and the UK government also sanctioned it in 2025. Officials also say the activity overlaps with groups tracked as Ethereal Panda and Red Juliett, though not all of it is necessarily tied to Integrity Tech.

The advisory lists eight flaws the attackers commonly exploited, and several are about a decade old. They include the Shellshock bug in GNU Bash, a file-read flaw in ProFTPD, a GitLab remote code execution bug and a Pulse Secure VPN file-read flaw, alongside holes in Apache Struts, ISC BIND, ONLYOFFICE and Strapi.

The hackers also used an open-source tool called EBurst for password spraying, trying common passwords across many accounts, against Microsoft Exchange and Microsoft 365 email. Another tool, DC.exe, tricked domain controllers, the servers that manage logins on a company network, into handing over account credentials.

For most people, the takeaway is that patching works. These attackers relied heavily on off-the-shelf scanners and years-old bugs, which suggests they hunted for the easiest, most neglected targets rather than the best-defended ones.

If you run IT for a business, school or council, the agencies’ advice is practical:

• Check your logs against the indicators of compromise in the advisory, including the IP addresses, domains and malware hashes it lists.
• Patch the eight listed flaws and replace products that no longer get security updates.
• Turn off services and ports you don’t use, especially remote access and file sharing.
• Require multifactor authentication for webmail, VPNs and other critical systems, and watch for unexpected Active Directory replication.

For individuals, the same lesson applies at home: keep routers and devices updated, since a botnet of more than 200,000 hacked consumer gadgets was part of this company’s toolkit.