WASHINGTON — In a coordinated escalation against state-backed cyber espionage, the U.S. Department of Justice and the Federal Bureau of Investigation announced the court-authorized seizure of two prominent malicious software domains tied to the Chinese government-linked threat group known as "Flax Typhoon."

The targeted domains supported "Microscan," a vulnerability scanning tool, and "FishHub," a specialized spear-phishing platform. Both tools were developed and maintained by the Integrity Technology Group, a China-based firm that has become a primary target of western sanctions and law enforcement actions over the past several years.

The domain seizures, sanctioned by a federal court in the Western District of Pennsylvania, were unveiled alongside a joint cybersecurity advisory issued by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA). The advisory warns that Chinese state-sponsored hackers are systematically leveraging commercial infrastructure, automated scanning frameworks, and large-scale Internet of Things (IoT) botnets to infiltrate critical infrastructure worldwide.

Main Facts: Disabling the Infrastructure of Flax Typhoon

The recent enforcement actions aim to deny Chinese-affiliated hackers operational access to vital components of their cyber espionage arsenal. Integrity Technology Group has long served as a commercial front or proxy for state-sponsored operators, developing, hosting, and maintaining sophisticated capabilities deployed against western democracies and international allies.

• Microscan: A high-speed vulnerability scanning framework powered by a Mirai-variant IoT botnet. Microscan was used to map networks, locate vulnerable endpoints, and execute cross-site scripting (XSS) and password-spraying attacks against platforms like Microsoft Exchange servers. Targets of Microscan included a South Carolina electric utility, major international airports in Japan and Poland, and various critical infrastructure entities and universities in Taiwan.
• FishHub: A spear-phishing platform engineered to deliver customized malware payloads directly into targeted enterprise networks once initial access was established. Documented victims of FishHub include higher education institutions in Taiwan.
• The Interagency Response: The operation highlights an aggressive whole-of-government approach that pairs traditional criminal and civil enforcement—such as domain seizures and indictments—with operational cyber actions and public-private threat intelligence sharing.

Chronology of U.S. Action Against Integrity Technology Group

The dismantling of Microscan and FishHub represents the latest chapter in a multi-year U.S. government campaign targeting Integrity Technology Group and its operational proxies.

2024: The Botnet Takedown

The U.S. government first brought widespread public attention to Integrity Technology Group during a major 2024 law enforcement operation. Authorities revealed that the company was the mastermind behind a massive botnet comprising hundreds of thousands of compromised consumer routers, cameras, and other IoT devices. This botnet was utilized to obfuscate the origin of malicious cyber traffic, allowing state-sponsored hackers to blend reconnaissance and exploitation activities with legitimate traffic and evade perimeter security controls.

2025: Economic Sanctions

Building upon the technical disruptions of the previous year, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) formally sanctioned Integrity Technology Group. The designation froze any U.S.-held assets of the firm and prohibited American citizens and businesses from engaging in commercial transactions with the company, effectively cutting the enterprise off from western financial and technological ecosystems.

2026: Domain Seizures and Joint Advisories

In the latest phase of the campaign, federal prosecutors in the Western District of Pennsylvania secured warrants to seize the domain names associated with Microscan and FishHub. Simultaneously, CISA, the FBI, and the NSA published an extensive joint advisory detailing the tactics, techniques, and procedures (TTPs) currently employed by Integrity Technology Group-backed operators.

Supporting Data: Tactics, Techniques, and Procedures (TTPs)

According to the joint advisory issued by CISA, the FBI, and the NSA, Chinese state-sponsored hackers have evolved their operational methodology. They increasingly combine automated tools with hands-on-keyboard exploitation to remain undetected within enterprise environments for extended periods.

The Attack Lifecycle

1. Reconnaissance and Scanning: Using the seized Microscan tool, actors sweep vast blocks of internet-facing infrastructure to identify unpatched vulnerabilities, particularly in edge-networking appliances and email servers.
2. Botnet Obfuscation: Traffic is routed through a distributed network of compromised IoT devices (utilizing Mirai-variant botnets), making it difficult for defenders to block malicious IP addresses without disrupting legitimate consumer traffic.
3. Initial Access and Persistence: Attackers deploy cross-site scripting and password spraying against enterprise assets, such as Microsoft Exchange servers. Once inside, they establish persistence by manipulating or abusing Virtual Private Network (VPN) software and legitimate administrative credentials.
4. Data Exfiltration: Threat actors use custom scripting tools to harvest and exfiltrate sensitive internal communications, credentials, and proprietary intellectual property.

Global Scale of Targeting

While initial investigations focused heavily on Taiwan—a frequent proving ground for Chinese cyber operations—the scope of targeted entities spans multiple continents and critical sectors. Confirmed victims include:

• Energy Sector: A prominent power company located in South Carolina, highlighting direct risks to the U.S. homeland power grid.
• Transportation: Major international airports situated in Poland and Japan.
• Education and Research: Multiple universities across Taiwan and other allied territories.

Official Responses and Statements from U.S. Leadership

Senior leadership across the U.S. national security apparatus emphasized that these operations reflect a strategic shift toward dismantling not just the hackers themselves, but the commercial and logistical enterprises that sustain them.

"Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing," said Chris Butera, Acting Executive Assistant Director for Cybersecurity at CISA.

Butera’s warning underscores deep-seated concerns within the intelligence community regarding "pre-positioning"—a strategy wherein foreign adversaries infiltrate water, energy, and transportation networks not for immediate financial gain or espionage, but to establish lingering access that can be triggered during a future geopolitical or military crisis.

Brett Leatherman, head of the FBI’s Cyber Division, echoed this sentiment, framing the takedown as a direct execution of the national cybersecurity strategy:

"Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them. Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises, acquiring or developing cyber tools and hosting infrastructure for actors targeting networks worldwide."

Broader Implications for Global Cybersecurity

The ongoing legal and technical campaign against Integrity Technology Group has far-reaching implications for the global cybersecurity landscape, private enterprise, and international relations.

1. The Blurring Lines Between Private Enterprise and State Espionage

The case illustrates how foreign intelligence services increasingly rely on nominally private companies to research vulnerabilities, develop custom malware, and host command-and-control infrastructure. This corporate veneer provides state actors with plausible deniability while allowing cyber arms dealers to operate with relative impunity inside friendly regulatory jurisdictions.

2. The Critical Infrastructure Threat

The presence of state-sponsored actors inside operational technology (OT) and industrial control systems (ICS) remains one of the most pressing national security challenges for western governments. Unlike traditional data breaches, where the primary concern is the theft of intellectual property or personal identifiable information (PII), compromises of critical infrastructure carry the physical risk of service disruption, blackouts, and physical damage.

3. Proactive Disruption as a Deterrent Strategy

By routinely seizing domains, sanctioning corporate entities, and publicizing detailed threat advisories, U.S. law enforcement is demonstrating a preference for aggressive, preemptive disruption. Rather than waiting for an attack to manifest or relying solely on defensive hardening within corporate networks, agencies are actively dismantling the logistical supply chain used by foreign threat actors.

As geopolitical tensions remain high, cybersecurity experts expect U.S. and allied agencies to continue leveraging cross-border judicial tools, intelligence sharing, and targeted economic sanctions to counter state-backed cyber threats before they can translate into catastrophic operational disruptions.