The Justice Department and FBI announced court-authorized seizures of infrastructure supporting two hacking tools allegedly operated by China-state-sponsored actors associated with Integrity Technology Group, a Chinese company with government contracts.
The October 8 action targeted Microscan, a vulnerability-scanning platform, and FishHub, a spear-phishing system. The allegations come from court documents unsealed in the Western District of Pennsylvania and have not been tested at trial.
What Microscan allegedly did
According to the Justice Department, Integrity Technology Group used a botnet of internet-of-things devices infected with a Mirai malware variant to conduct wide-scale network reconnaissance. Microscan allegedly helped identify vulnerabilities that clients could later exploit.
The government says scanning targets included a South Carolina power company, a multinational nonprofit, airports in Japan and Poland, Taiwanese natural-gas and electric-power companies, and two Taiwanese universities. Authorities seized the domain c0cc[.]cc, which they say was used to access Microscan.
What FishHub allegedly did
FishHub allegedly facilitated spear-phishing attacks and downloaded additional malware after an initial compromise. That malware could provide unauthorized remote access or search for and exfiltrate selected files. The Justice Department identified about 20 Taiwanese universities as confirmed victims.
Five domains were seized in connection with FishHub. AskNovus has intentionally defanged the names by placing brackets around the dots: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net.
Guidance for network defenders
- Review the joint government advisory for indicators of compromise associated with Integrity Tech activity.
- Investigate unexplained vulnerability scanning, suspicious authentication events and connections to the defanged domains.
- Patch internet-facing systems and isolate unsupported internet-of-things devices.
- Use phishing-resistant multifactor authentication where possible and monitor for malware downloads after credential theft.
The Justice Department described this as its second public technical disruption of Integrity Tech infrastructure. In September 2024, authorities disrupted a Mirai botnet that the government said included more than 200,000 consumer devices in the United States and abroad.
Primary documents are the Justice Department release dated October 8, the linked affidavit and seizure warrant, and the accompanying FBI-led cybersecurity advisory. Organizations should rely on the technical advisory for detection steps rather than on news summaries.
For more platform, security and policy developments, visit AskNovus Tech and Technology News.
Featured image credit: Taylor Vick/Unsplash.