FBI disrupts Chinese hacking tools used to breach critical infrastructure

The FBI seized seven domains that supported MicroScan and FishHub, platforms allegedly operated by China-based Integrity Technology Group. The disruption targeted infrastructure linked to Flax Typhoon, a Chinese state-sponsored hacking group. The tools mattered because they supported both finding vulnerable systems and exploiting organizations after access was gained.

MicroScan was a Python-based scanner with more than 1,300 penetration-testing scripts. It worked with a Mirai-infected botnet to scan internet-connected systems, including energy companies, airports, and universities. FishHub supported spear-phishing and delivered malware to networks that had already been compromised.

The malware provided unauthorized remote access. Attackers could search for files and exfiltrate data to Integrity Tech-controlled servers. The FBI seized c0cc.cc, five domains used to deliver malware, and 98aiblog.com, which was tied to SoftEther VPN software. The seizures and joint advisory were intended to disrupt operations and help organizations understand the threat.

A vulnerability scanner is a tool that checks websites, services, and networked systems for known security weaknesses. It matters because a scanner can help attackers identify promising targets quickly. MicroScan was developed by Integrity Technology Group and used to locate flaws in networks connected to the internet.

The platform was Python-based and contained more than 1,300 penetration-testing scripts. Those scripts targeted widely used software such as Oracle WebLogic, Apache Struts, WordPress, Jenkins, and other applications. MicroScan also worked with a botnet of internet-connected devices infected with Mirai malware, allowing attackers to scan potential targets at broad scale.

The FBI linked scanning to later breaches at two Taiwanese universities. Their networks were scanned in August 2022 and March 2023 and were subsequently breached. Investigators identified eight commonly targeted vulnerabilities, including flaws in GitLab, Pulse Secure VPN, Apache Struts, GNU Bash, and ProFTPD.

The campaign had a broad geographic and organizational reach. The advisory identified targets in North America, Southeast Asia, and Africa, while the article specifically mentions the United States, Taiwan, Japan, and Poland. Targets included government agencies, critical manufacturing, healthcare, information technology, law enforcement, education, religious organizations, airports, and energy providers.

The named examples show how varied the targets were. MicroScan scanned a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and electricity companies, and universities. Investigators also found data and files from more than 20 organizations on a server linked to FishHub, including six universities in Taiwan.

MicroScan contained more than 1,300 penetration-testing scripts. They checked widely used products such as Oracle WebLogic, Apache Struts, WordPress, Jenkins, and other applications. The article does not provide a total number of countries or all affected organizations, and it says some named targets were not confirmed as breached.

The attackers moved from discovery to intrusion by combining separate capabilities. MicroScan identified security weaknesses in websites and services, while FishHub supported spear-phishing and malware delivery against networks that were already compromised. This created a path from finding an exposed system to operating inside it.

The malware installed through FishHub gave attackers unauthorized remote access. It allowed them to search for specific files and exfiltrate data to servers controlled by Integrity Technology Group. SoftEther VPN software, linked to the seized 98aiblog.com domain, was installed on compromised systems to maintain remote access. The FBI found files from more than 20 organizations on a FishHub-linked server.

The source does not say that attackers browsed stolen emails. It does describe searching for files and stealing data, which could include sensitive information, but the article does not identify email browsing as a confirmed activity. It also does not provide details about every individual intrusion or stolen file.

Domain seizures can interrupt the online infrastructure that attackers use to operate their tools. Here, the FBI took control of domains supporting MicroScan, FishHub, malware delivery, and SoftEther VPN access. The seized domains now show FBI notices identifying Flax Typhoon and Integrity Technology Group.

The disruption affected c0cc.cc, which provided access to MicroScan, five domains used to deliver malware, and 98aiblog.com, which was tied to SoftEther VPN software. That software helped maintain remote access to compromised systems. The FBI, CISA, NSA, and international partners also issued a joint advisory explaining the tools and infrastructure.

The FBI’s stated practical effect is to make China-linked operations harder by disrupting contractors and companies that expand cyber capabilities. The seizures do not prove that every compromised system is safe or that all related activity has stopped. Organizations still need to investigate affected networks and address the vulnerabilities described in the advisory, while recognizing that not all overlapping activity is necessarily linked to Integrity Tech.

Integrity Technology Group allegedly acted as a contractor and capability provider. U.S. authorities say the China-based company had contracts with the Chinese government. Its role was important because it supplied platforms and infrastructure that China-linked threat actors could use for scanning, intrusion, remote access, and data theft.

The company developed MicroScan, which identified security weaknesses through more than 1,300 scripts. It also allegedly operated FishHub, which supported spear-phishing, malware delivery, file searches, and data exfiltration. Servers and domains linked to Integrity Tech held stolen information and helped attackers reach compromised systems.

The activity overlaps with operations tracked as Flax Typhoon, Ethereal Panda, and Red Juliett. The agencies cautioned that not all overlapping activity may necessarily be linked to Integrity Tech. The FBI said China relies on contractors and other companies to expand cyber operations, and that disrupting these organizations can make it harder for China-linked hackers to target American networks.

A software vulnerability is a weakness in an application, service, or system that can let attackers read data, change files, or run code without permission. The article lists flaws affecting ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE, Strapi, GNU Bash, Pulse Secure VPN, and GitLab. These weaknesses gave attackers potential routes into exposed networks.

Patching removes or fixes known defects, so scanners and attackers cannot use the same flaw. Disabling an exposed service removes an unnecessary entry point from the internet. Multifactor authentication adds another verification step, making a stolen password alone less useful. These are established security practices; the article identifies the vulnerabilities but does not describe specific organizations applying these defenses.

Together, the measures reduce the chance that scanning becomes a successful breach. They are especially relevant because MicroScan tested widely used software and FishHub operated after compromise. Organizations also need to investigate suspicious access, because patching a flaw does not automatically remove malware or previously established remote access.