US seizes Integrity Tech hacking-tool domains and charges MonsterCloud founder with ransomware recovery fraud

On October 8 Integrity Technology Group lost a set of addresses ^[2]. The FBI seized c0cc.cc, the domain the company used to reach its Microscan scanner, and five domains that delivered FishHub malware ^[3]. A seventh, 98aiblog.com, was tied to SoftEther VPN software installed on compromised systems to keep remote access, BleepingComputer reported ^[3]. A court in the Western District of Pennsylvania authorized the seizures ^[1]. Microscan was still reachable through c0cc.cc as recently as September 9, according to the FBI affidavit as described by Security Affairs ^[4]. The seizure came 29 days later ^[39].

The day before, prosecutors charged Zohar Pinhasi, owner of the Florida ransomware-recovery firm MonsterCloud, with two counts of wire fraud and one of wire fraud conspiracy ^[23][24][38]. In both cases the government acted against a supplier. One is a Chinese contractor the US sanctioned for providing products to state-sponsored groups such as Flax Typhoon ^[16]. The other is a recovery vendor that, according to the Justice Department, claimed proprietary decryption tools that did not exist and paid the attackers instead ^[25]. We think neither action reaches the access an attacker already holds inside a victim network.

What the seizure leaves running

Microscan was one step in a longer chain. The joint advisory describes reconnaissance with open-source scanning tools ^[12], and SecurityWeek's summary names them: BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe and WPScan ^[11]. Initial access came partly through EBurst, a password-spraying tool aimed at Microsoft Exchange and Microsoft 365 mail accounts ^[11][12]. The seizure list is seven domains, all tied to Microscan, FishHub or SoftEther ^[3].

After entry, the advisory describes a kit for staying in and taking data. The actors installed SoftEther VPN clients on victim devices to obscure command-and-control traffic ^[12]. DC.exe let them trick a domain controller into handing over Active Directory data, including account credentials ^[12]. For mail, office-cli gave continuous access to Outlook 365 accounts ^[12]. "The threat actors collect account credentials and exfiltrate victim email data from on-premises systems and cloud-based services," the advisory reads ^[13]. In some cases they restricted access to the stolen data to IP addresses in Xiamen, China ^[13].

Taking 98aiblog.com touches one part of that kit ^[3]. In our view, credentials pulled through DC.exe and mailbox access held through office-cli ^[12] stay usable until the victim resets them, whatever happens to the domains. The advisory is written with that case in mind. It lists indicators of compromise and includes advice for incident responders who think they may already have been compromised ^[14]. Its main mitigations are to disable unused services and ports, including remote access and file sharing protocols, and to sanitize web application input against cross-site scripting ^[14]. It also calls for identity, credential and access management policies, with multifactor authentication where possible ^[14].

The bugs Microscan hunted are old. Investigators identified eight vulnerabilities the hackers commonly targeted ^[6]. BleepingComputer's list includes CVE-2015-3306, a ProFTPD unauthorized file read, CVE-2015-5477, an ISC BIND denial-of-service flaw, and CVE-2016-3081 in Apache Struts ^[6]. Microscan's more than 1,300 Python scripts covered Apache Struts, Juniper ScreenOS, Jenkins, OpenSSL, Oracle, Rejetto HFS, WebLogic and WordPress, among other services ^[5]. The FBI affidavit dates the tool's use to as early as 2017 ^[4]. A host still exposed to those flaws remains findable with the open-source scanners named in the same advisory ^[11].

Scanned targets and confirmed breaches

The named targets drew the headlines. According to court documents, Microscan scanned a South Carolina power company, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese natural gas and power companies, and two Taiwanese universities ^[7]. A Mirai-variant botnet of internet-of-things devices supported that scanning ^[7]. BleepingComputer reported that the FBI did not disclose whether the named power companies, airports and energy providers were breached ^[8]. The breaches the affidavit confirms are narrower: two Taiwanese universities scanned with Microscan in August 2022 and March 2023 and later breached ^[8].

Reports of FishHub's reach disagree. The Cyber Express counts about 20 Taiwanese universities among confirmed victims ^[10]. BleepingComputer, citing the seizure affidavit, says investigators found data and files from more than 20 organizations on a FishHub-linked server, six of them universities in Taiwan ^[9].

The advisory's victim list is wider than the affidavit's. It names US government agencies, critical manufacturing, healthcare, information technology, law enforcement, educational institutions and religious organizations, along with organizations in Southeast Asia, Africa and North America ^[15]. The activity overlaps with groups tracked as Flax Typhoon, Ethereal Panda and Red Juliett, but the agencies say not all of it may be linked to Integrity Tech ^[15].

Second disruption, same company

In September 2024 the Justice Department announced it had disrupted Integrity Tech's Mirai botnet, which it said included more than 200,000 consumer devices ^[17]. SecurityWeek identifies that network as the Raptor Train botnet ^[16]. Court documents reviewed by The Hacker News, as reported by Security Affairs, show the botnet database held records for more than 1.2 million infected devices in June 2024 ^[18]. More than 385,000 were in the US. About 260,000 were actively infected at the time, about 126,000 of them in the US ^[18]. Microscan was still reachable in September 2026 ^[4], after the US sanctioned the company in 2025 and the European Union followed in March 2026 ^[16].

Prosecutor Troy Rivetti called the October 8 seizures the "second disruption of Integrity Tech's massive operations in as many years" ^[19]. SecurityWeek reports that the company is believed to work with Chinese state-sponsored groups beyond Flax Typhoon ^[16]. Security Affairs wrote: "The case shows that taking down a group's infrastructure does not necessarily stop its activities for good" ^[22]. We think the record supports treating Integrity Tech as a sustained operation that kept its tools online through a botnet takedown and two rounds of sanctions ^[16][4].

The officials framed the action as a cost imposed on the supplier. "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure," said Brett Leatherman, assistant director of the FBI's Cyber Division ^[20]. Chris Butera, CISA's acting executive assistant director for cybersecurity, said: "Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing" ^[21].

The recovery that left the attacker inside

The indictment lays out the sales process step by step. MonsterCloud charged an exploratory fee of $2,500 to $10,000, then obtained the client's ransom note and a sample of encrypted files ^[26]. In many instances Pinhasi sent those samples to the cybercriminal, got decrypted samples back, and showed them to the client as proof that MonsterCloud could decrypt ^[26]. Prosecutors wrote that this led clients to buy full recovery, "a more expensive service, costing up to two or more times the ransom" ^[26]. MonsterCloud's contracts said the company would contact a cybercriminal after exhausting all other options. Prosecutors say dealing with the criminals was often the first step ^[28].

Over five years ending in 2023, Pinhasi is accused of charging hundreds of clients more than $19 million and paying more than $8 million in ransoms ^[25]. The gap is roughly $11 million ^[34]. The markup was uneven. In August 2023 he allegedly paid about $8,200 and billed about $150,000, roughly 18 times the ransom ^[27][35]. In October 2021 he allegedly paid about $236,000 and billed about $380,000, about 1.6 times ^[27][36]. Across the whole scheme the ratio is about 2.4 to 1 ^[37].

Former clients have a second problem beyond the bill. "Pinhasi claimed to fix ransomware while never remediating the underlying threat. Instead, he turned the victim's crisis into his own profit center," said James C. Barnacle Jr., an FBI assistant director ^[29]. The FBI and CISA advise against paying ransoms in part because payment does not guarantee the attackers leave the network ^[30]. By the indictment's account, a MonsterCloud client got a decryptor bought from the people who encrypted it, through a vendor the FBI says never dealt with the underlying threat ^[25][29].

Those clients' records show a recovery fee. Prosecutors say part of that fee went to the criminals as ransom, and the clients were not told ^[25]. The reporting does not name the groups that received the $8 million or say whether any of them were subject to sanctions. The Q&A on MonsterCloud's site reads: "While we strongly advocate not paying ransoms yourselves, we have extensive experience working with ransomware perpetrators and sometimes resort to other means to resolve the ransomware incident for our clients. All terms are disclosed in our service contract." ^[31]

Pinhasi pleaded not guilty in federal court in Brooklyn and was released on a $2 million bond ^[24]. Each count carries up to 20 years, up to 60 in total ^[23][24]. A judge granted a one-month delay, noting that attorneys are in plea negotiations ^[24].

Exposure before enforcement

ProPublica reported in 2019 that MonsterCloud claimed its own recovery methods while paying ransoms without telling victims, law enforcement agencies among them ^[32]. The alleged scheme ran until 2023 and reached hundreds of companies in the US and Canada ^[25][32]. MonsterCloud's site is still up, with a contact form and testimonials from law enforcement agencies and a former FBI official ^[32]. Earlier this year, three former ransomware negotiators were sentenced to prison for deceiving their employers' clients and conspiring with ransomware affiliates to extort those organizations ^[33]. On the Chinese side, the US sanctioned Integrity Tech in 2025 ^[16], and Microscan was online in September 2026 ^[4].