Justice Department disrupts China's Integrity Tech for a second time in two years
US agencies say China-based Integrity Tech, a firm with Chinese government ties, equips hackers who target critical infrastructure. The Justice Department's domain seizures are its second disruption of the firm in two years; the joint advisory leaves the edge-device entry point for owners to close.
Not a builder's beat, but builders have a standing stake in it.
Exposure map. Microscan scanned a South Carolina power company and Japanese and Polish airports. About 20 Taiwanese universities were FishHub victims. Edge devices are targeted for stealthy access. Government and healthcare are named targets. Integrity Tech lost at least six seized domains.
- Who's exposed exposure South Carolina power company Named target of Microscan vulnerability scanning, alongside Taiwanese natural gas and power companies, claim 4
- Who's exposed exposure Japanese and Polish airports Scanned by Microscan, as was a multinational NGO, claim 4
- Who's exposed exposure Taiwanese universities About 20 confirmed victims of FishHub spear phishing, which dropped malware for remote access or file theft, claim 5
- Who's exposed exposure Edge-device owners Targeted for long-term, stealthy access because these devices are not closely monitored, claim 10
- Who's exposed exposure Government and healthcare orgs Named targets in the advisory, along with critical manufacturing, US law enforcement and education, claim 13
- What it costs cost Integrity Tech Lost at least six seized domains: one used to access Microscan and five used to deliver FishHub malware, claim 17
| Who | How | Kind | Claim |
|---|---|---|---|
| South Carolina power company | Named target of Microscan vulnerability scanning, alongside Taiwanese natural gas and power companies | exposure | 4 |
| Japanese and Polish airports | Scanned by Microscan, as was a multinational NGO | exposure | 4 |
| Taiwanese universities | About 20 confirmed victims of FishHub spear phishing, which dropped malware for remote access or file theft | exposure | 5 |
| Edge-device owners | Targeted for long-term, stealthy access because these devices are not closely monitored | exposure | 10 |
| Government and healthcare orgs | Named targets in the advisory, along with critical manufacturing, US law enforcement and education | exposure | 13 |
| Integrity Tech | Lost at least six seized domains: one used to access Microscan and five used to deliver FishHub malware | cost | 17 |
What happened
- Microscan's scanning targets included a South Carolina power company, a multinational NGO, Japanese and Polish airports, and Taiwanese gas and power companies.
- FishHub dropped follow-on malware after spear-phishing compromises to give clients remote access or pull files, and about 20 Taiwanese universities were confirmed victims.
- The first disruption, announced in September 2024, took down an Integrity Tech Mirai botnet of more than 200,000 consumer devices in the US and abroad.
- A joint advisory from CISA, the FBI, NSA and international partners links the activity to tradecraft publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett.
Why it matters
- What it costs cost Integrity Tech has to replace at least six domains and a malware delivery chain. Edge-device owners still have the same patching backlog they had before the seizures.
- Who has to decide decision Patch order for edge devices should follow the advisory's list of known exploited CVEs. Those flaws are already being exploited, and seizing a domain does not close any of them.
- Who's exposed exposure Government, critical manufacturing, healthcare, US law enforcement and education organizations are named targets, so CISA's call to hunt for existing compromise applies to them first.
- What it sets up precedent The FBI says its Cyber Strategy goes after the companies that support attackers as well as the attackers themselves, so we'd expect more actions aimed at PRC contractors like Integrity Tech.
The count of two comes from the Justice Department itself. U.S. Attorney Troy Rivetti called the seizures "our second disruption of Integrity Tech's massive operations in as many years" [7]. This round took at least six named domains: c0cc[.]cc, which Integrity Tech used to reach Microscan, and five that delivered FishHub malware [3][5][17].
The FBI argues that going after the contractor raises the cost of the whole operation. "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity," said Brett Leatherman, assistant director of the FBI's Cyber Division. "By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure." [12]
The joint advisory describes an access path the seizures do not touch. The actors go after edge devices that their owners do not closely monitor, so they can hold access for the long term [10]. Besides botnets, they use VPN infrastructure and living-off-the-land techniques [8]. We think an actor already sitting on an unmonitored edge device loses little when a phishing domain goes dark.
Neither release measures how far scanning or intrusions fell after the 2024 botnet takedown. Announcing the second round, Rivetti said, "These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world" [14].
What to watch
- FBI or CISA figures on Microscan scanning volume after the seizures, the first measure of whether either disruption cut activity.
- Replacement domains for the seized Microscan and FishHub infrastructure, and how quickly they appear.
- Charges against named Integrity Tech staff in the Western District of Pennsylvania case.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Justice Department and FBI announced court-authorized seizures to deny malicious cyber actors access to two hacking tools, Microscan and FishHub, used to scan and, in some cases, hack U.S. and foreign critical infrastructure systems and other networks.
- [2]
Court documents unsealed in the Western District of Pennsylvania allege that actors working for Integrity Technology Group, a PRC-based company, operated and used the tools; Integrity Tech has contracts with the PRC government.
- [3]
Integrity Tech created a botnet of IoT devices infected with a Mirai variant that facilitated its Microscan vulnerability scanning, and accessed Microscan through one of the seized domains, c0cc[.]cc.
- [4]
Targets of Microscan scanning include a U.S. power company based in South Carolina, a multinational NGO, Japanese and Polish airports, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities.
- [5]
FishHub facilitated exploitation through spear phishing; after initial compromise it downloaded additional malware that gave Integrity Tech's clients remote access or searched for and exfiltrated files. Confirmed victims included approximately 20 Taiwanese universities. Five seized domains helped deliver this malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net.
- [6]
The action is the Department's second public technical disruption of Integrity Tech's hacking infrastructure; in September 2024 it announced the court-authorized disruption of Integrity Tech's Mirai botnet of more than 200,000 consumer devices in the United States and worldwide.
- [7]
"These seizures, our second disruption of Integrity Tech's massive operations in as many years, send another clear message to cybercriminals from the PRC and elsewhere of the Department's dedication to defending and maintaining cybersecurity in the United States and abroad."
- [8]
CISA, FBI, NSA and international partners issued a joint advisory warning that Integrity Tech, a China-based company with ties to the Chinese government, is enabling threat actors to target critical infrastructure sectors worldwide using large-scale botnets, virtual private network infrastructure and living off the land, based on activity observed in North America, Southeast Asia and Africa.
- [9]
Integrity Tech-enabled threat actors use tactics, techniques and procedures consistent with activity publicly known as Flax Typhoon, Ethereal Panda and Red Juliett.
- [10]
To maintain long-term, stealthy access to networks, these actors target edge devices that are not closely monitored by the targeted organization.
- [11]
The advisory's recommended steps for securing edge infrastructure include patching the listed known exploited CVEs.
- [12]
"The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure."
- [13]
The advisory says the actors targeted critical infrastructure sectors including government, critical manufacturing and healthcare, as well as US law enforcement and education organizations.
- [14]
"These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims' vulnerabilities."
- [15]
"Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them."
- [16]
CISA, FBI and partners urge all organizations, especially in critical infrastructure, to review the advisory, hunt for signs of compromise, and implement the recommended mitigations.
- [17]
At least six seized domains are named in the release: one used to access Microscan and five used to deliver FishHub malware.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.