Integrity Tech loses seven domains tied to its Microscan and FishHub tools
DOJ and FBI seized seven domains tied to Integrity Tech's Microscan and FishHub tools, the second action against the Flax Typhoon contractor. The company still had live scanning and phishing infrastructure to seize after the September 2024 botnet takedown.
The Watch · Security desk
Of seven seized domains, five delivered FishHub malware, one gave Integrity Tech access to Microscan and one was tied to remote administration software.
- FishHub malware delivery, claim 14 5 of 7 domains 71% computed
FishHub malware delivery The rest of the 7
- Microscan access, claim 14 1 of 7 domains 14% computed
Microscan access The rest of the 7
- Remote administration software, claim 14 1 of 7 domains 14% computed
Remote administration software The rest of the 7
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| FishHub malware delivery | 5 domains | 7 domains | 71% (computed) | 14 |
| Microscan access | 1 domains | 7 domains | 14% (computed) | 14 |
| Remote administration software | 1 domains | 7 domains | 14% (computed) | 14 |
What happened
- Microscan targets included a South Carolina power company, Japanese and Polish airports, Taiwanese gas and power firms, a multinational NGO and two Taiwanese universities.
- FishHub, alleged to work through spear phishing, pulled down further malware after a compromise, and five of the seized domains delivered it to give clients remote access or take files.
- Confirmed FishHub victims included approximately 20 Taiwanese universities.
Why it matters
- exposure Microscan hits are reconnaissance for other operators' intrusions, so the party behind a later compromise of a scanned network may be one of Integrity Tech's clients.
- decision Defenders in the sectors on the target list have a concrete task: match the indicators of compromise in the FBI advisory against historical logs.
- precedent We'd expect more seizures aimed at supplier infrastructure, since the National Security Division's Eisenberg said it will keep using every tool to disrupt Flax Typhoon.
One seized domain gave Integrity Tech access to Microscan [3]. Five delivered the malware that FishHub downloaded after an initial compromise [6]. The seventh was tied to remote administration software that connected several victims' networks to an Integrity Tech server [8]. One plus five plus one accounts for all seven [14].
According to the unsealed court documents, Microscan checked victim networks for vulnerabilities that Integrity Tech's clients would later exploit [2]. The FishHub malware then gave those clients remote access [6]. In our view, a Microscan hit establishes that reconnaissance happened and says little about who exploited the network next.
FBI Assistant Director Brett Leatherman said, "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity." [12] Tooling built for multiple clients points to a sustained supply operation. Because the action targets tools and domains, no patch deadline applies.
The September 2024 action disrupted a Mirai botnet of more than 200,000 consumer devices [9]. U.S. Attorney Troy Rivetti of the Western District of Pennsylvania called the new seizures "our second disruption of Integrity Tech's massive operations in as many years" [11]. Integrity Tech still had Microscan, FishHub and seven domains to lose at the second action [1], and the court documents say it has contracts with the PRC government [15].
That supports saying the group was not stopped. Saying it was slowed needs a baseline the release does not supply: when Microscan and FishHub were built, and whether the 2024 action changed how they ran.
What to watch
- Whether replacement domains for Microscan or FishHub appear, which would show how fast Integrity Tech rebuilds.
- Further filings in the Western District of Pennsylvania that name individuals behind the tools.
- Revisions to the FBI advisory's indicators of compromise as defenders report matches.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives60
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Justice Department and FBI announced court-authorized seizures, including seven domains, to deny access to Microscan and FishHub, two intrusion tools used by malicious cyber actors to scan and, in some cases, hack U.S. and foreign critical infrastructure systems and other networks.
- [2]
According to court documents, Integrity Tech created and used a network of internet-connected devices infected with a variant of Mirai malware, and the botnet employed the Microscan tool to conduct reconnaissance of victim computer networks for vulnerabilities that its clients would later exploit.
- [3]
Integrity Tech was able to access Microscan through one of the seized domains.
- [4]
Targets of Microscan vulnerability scanning included a U.S. power company based in South Carolina, a multi-national NGO, Japanese and Polish airports, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities.
- [5]
FishHub is alleged to have facilitated the exploitation of computer networks through spear phishing; after an initial network compromise, it downloaded additional malware to the victim network.
- [6]
The additional malware FishHub downloaded was delivered through five of the seized domains and gave Integrity Tech's clients unauthorized remote access to the victim network or searched for specific files and sent them to servers controlled by Integrity Tech.
- [7]
Confirmed victims of FishHub activity included approximately 20 Taiwanese universities.
- [8]
Integrity Tech used unauthorized remote administration software tied to a seventh seized domain to connect several victims' networks to an Integrity Tech server.
- [9]
In September 2024, the Justice Department announced the court-authorized disruption of Integrity Tech's Mirai malware botnet, which consisted of more than 200,000 consumer devices in the United States and worldwide.
- [10]
The FBI, along with other U.S. and foreign-partner agencies, published a cyber security advisory with indicators of compromise associated with Integrity Tech intrusion activity, designed to help network defenders identify and respond to it.
- [11]
"These seizures, our second disruption of Integrity Tech's massive operations in as many years"
- [12]
"The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity."
- [13]
Assistant Attorney General for National Security John A. Eisenberg said the National Security Division will continue to use every tool at its disposal to disrupt the Flax Typhoon threats and dismantle the infrastructure sustaining them.
- [14]
The seven seized domains break down as one for Microscan access, five for FishHub malware delivery and one for remote administration software, matching the seven announced.
- [15]
As alleged in court documents unsealed in the Western District of Pennsylvania, cyber actors working for Integrity Technology Group, a PRC-based company, operated and used the tools as part of hacking activity known to the private sector as Flax Typhoon; Integrity Tech has contracts with the PRC government.
Sources
1 independent publisher whose own reporting we read for this story.
- justice.govwww.justice.gov
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.