On Thursday, October 8, the US Justice Department and FBI announced the seizure of internet domains supporting two tools operated by Integrity Technology Group, a China-based company. The tools are MicroScan, a vulnerability scanner, and FishHub, a spear-phishing and malware-delivery tool. Court documents connected to the action were unsealed in the Western District of Pennsylvania. The same day, the FBI, CISA, NSA and partner agencies in six other countries published joint cybersecurity advisory AA26-281A. It describes how Integrity Tech's tooling enabled hacking by actors linked to the Chinese government, and it lists the vulnerabilities those actors exploited.

According to the advisory, the initial-access activity has been observed since at least mid-January 2021. Targets included government entities and organizations in critical manufacturing, healthcare, information technology, law enforcement, education and the religious sector. The agencies say the activity overlaps with groups that private-sector researchers publicly track as Flax Typhoon, Ethereal Panda and Red Juliett, while noting that vendor tracking may not map one-to-one to US government attribution. That attribution comes from the authoring agencies.

What was seized

The DOJ press release (26-1155) lists the seized domains. They include c0cc[.]cc, which the DOJ says Integrity Tech used to access MicroScan, and five domains tied to FishHub malware delivery: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net. Several of the FishHub domains borrow the names of well-known consumer and enterprise services, a common way to make phishing infrastructure look legitimate at a glance.

BleepingComputer reported that seven domains were seized in total. The seventh, 98aiblog[.]com, was used for access over SoftEther VPN. According to the DOJ, the investigation was led by the FBI's San Diego and Baltimore field offices in coordination with the FBI Cyber Division. The US Attorney's Offices for the Western District of Pennsylvania and the District of Maryland were involved, and the National Police Agency of Japan provided substantial assistance.

"The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace," Assistant Attorney General for National Security John A. Eisenberg said in the DOJ announcement. US Attorney Troy Rivetti of the Western District of Pennsylvania said the seizures are the second disruption of Integrity Tech's operations "in as many years."

Who wrote the advisory

AA26-281A is titled "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data." Its co-authors are:

  • FBI, CISA and NSA (United States)
  • National Cyber Security Centre (United Kingdom)
  • Australian Signals Directorate's Australian Cyber Security Centre
  • Canadian Centre for Cyber Security
  • Japan's National Police Agency and National Cybersecurity Office
  • National Cyber Security Centre New Zealand
  • Spain's Centro Nacional de Inteligencia (CNI)

That means all five Five Eyes countries signed on, plus Japan and Spain. The Record describes the document as a 58-page advisory covering tools Chinese actors have used over roughly six years. The advisory calls Integrity Tech a for-profit company with links to the Chinese government.

The tooling, as the agencies describe it

The advisory describes a mix of automated and hands-on tooling. According to the agencies:

  • MicroScan is a vulnerability scanner with more than 1,300 scripts. It has been in use since 2017.
  • EBurst was used for password spraying against Microsoft Exchange and Office 365.
  • SoftEther VPN was used to keep persistent access to compromised environments.
  • FishHub, named in the DOJ action, supported spear-phishing and malware delivery. BleepingComputer reported that data from more than 20 organizations was found on a server linked to FishHub.

BleepingComputer also reported that targets scanned with MicroScan included a South Carolina power company, airports in Japan and Poland, and Taiwanese natural gas and electricity companies. The FBI did not say whether any of those organizations were breached. According to the same report, the court affidavit confirms breaches at two Taiwanese universities that were scanned with MicroScan in August 2022 and March 2023.

"The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity," FBI Cyber Division Assistant Director Brett Leatherman said in the DOJ announcement. Chris Butera, CISA's acting executive assistant director for cybersecurity, said Chinese government hackers "continue to position themselves within critical infrastructure networks." Paul Chichester, director of operations at the UK NCSC, said the "breadth of sectors that have been targeted across the globe demonstrate the extent of the threat."

Exploited vulnerabilities

The advisory lists CVEs exploited in this activity. These include the following. An asterisk marks CVEs that the advisory says were newly added to CISA's Known Exploited Vulnerabilities (KEV) catalog:

  • CVE-2014-6278
  • CVE-2015-3306*
  • CVE-2015-5477*
  • CVE-2016-3081*
  • CVE-2019-11510
  • CVE-2021-22205
  • CVE-2021-3199*
  • CVE-2023-22894*

Most of these flaws are several years old, and some are more than a decade old. The agencies' description of the work as a mix of automated scanning and hands-on hacking fits that pattern. A scanner with a large script library is most productive against systems that were never patched or are past end of life. CISA added five of these CVEs to KEV on October 8 with an October 11 deadline for federal civilian agencies; that deadline has passed.

Context: Integrity Tech has been targeted before

This is not the first government action against the company. BleepingComputer notes that in September 2024 the Justice Department disrupted a Mirai-based botnet of more than 200,000 devices that it tied to Integrity Tech. The UK sanctioned the company in 2025, and the European Union followed with sanctions in 2026. The October 8 action goes after a different layer of the operation. It targets the reconnaissance and initial-access tooling that the agencies say other actors relied on, not the infrastructure of compromised devices.

What It Means for Defenders

Taking down domains disrupts infrastructure, but it does not fix exposure. Any organization that was scanned or phished through these tools may still have the weaknesses those tools found. Based on the mitigations in AA26-281A, defenders should prioritize the following:

  • Patch the listed CVEs, starting with the KEV additions. Inventory internet-facing assets against every CVE in the advisory. Check each newly added entry (CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894) in CISA's KEV catalog for its due date and required action. Confirm fixed versions against each vendor's advisory or the NVD record.
  • Replace end-of-life systems. The advisory pairs patching with replacing EOL products. A decade-old CVE that is still exploitable usually means a device that no longer receives fixes.
  • Enforce MFA on webmail and VPN. The agencies describe EBurst password spraying against Exchange and Office 365. MFA on those services, and on remote-access VPNs, directly addresses that technique. Also review sign-in logs for spray patterns: many accounts, few attempts per account, from shared sources.
  • Look for unauthorized VPN software. SoftEther VPN was used for persistence. Hunt for unexpected VPN clients, services or outbound tunnels on servers and endpoints that should not have them.
  • Monitor for unexpected Active Directory replication. The advisory recommends watching for unexpected AD replication, which can signal DCSync-style credential theft. It also recommends watching for unauthorized living-off-the-land (LOTL) activity, meaning the abuse of built-in administrative tools.
  • Sanitize input on web applications. The agencies specifically call out input sanitization against cross-site scripting.
  • Segment networks and keep offline backups. Segmentation limits lateral movement after initial access. Offline backups preserve recovery options.
  • Check logs for the seized domains. Search DNS, proxy and email gateway logs for the domains listed above. Do this especially for traffic before October 8, since that would predate the seizure. The full advisory contains the agencies' indicators of compromise and should be the authoritative list.

Organizations in the sectors the advisory names, including government, critical manufacturing, healthcare, IT, law enforcement, education and religious organizations, should read the full advisory. Report suspected activity to the FBI or CISA in the US, or to the relevant national authority elsewhere.

Sources