FBI seizes domains behind Microscan and FishHub, hacking tools that US officials tie to China's Integrity Tech and Flax Typhoon

The Justice Department and the FBI said on Thursday that they had seized seven domains used to operate two hacking tools, Microscan and FishHub. US officials say both were built by Integrity Technology Group, a Beijing-based company that holds contracts with the Chinese government and is linked to the state-sponsored group Flax Typhoon. A court in the Western District of Pennsylvania authorized the seizures. The FBI, CISA and NSA released a joint advisory at the same time, and The Record says US officials published a 58-page advisory covering tools used over the past six years. Prosecutors say Integrity Tech used a botnet of IoT devices infected with a Mirai variant to support Microscan, a vulnerability-scanning platform. Between April and December 2022, Microscan was used against a South Carolina power company, a multinational NGO, airports in Japan and Poland, and Taiwanese gas and power companies. FishHub supported spear-phishing intrusions and file theft, and was used against at least 20 universities in Taiwan. The Record describes the action as an international effort. "The PRC relies on contractors and enabling companies to expand the reach and scale of its malicious cyber activity," said Brett Leatherman of the FBI's Cyber Division. The US disrupted Integrity Tech's Raptor Train botnet in 2024 and sanctioned the company in 2025.