On 8 October 2026, the Department of Justice and the FBI announced they had seized six domain names tied to two pieces of hacking infrastructure: MicroScan, a vulnerability-scanning platform, and FishHub, a spear-phishing delivery system. Both were built and operated by Integrity Technology Group, a Beijing-based company that the US Treasury sanctioned in January 2025 for supplying hacking capability to Flax Typhoon, a Chinese state-linked threat actor the FBI has tracked since at least 2021. The same day, eight countries’ cybersecurity agencies — the FBI, CISA, NSA, the UK’s NCSC, Australia’s ACSC, Canada’s Cyber Centre, Japan’s NPA and NCO, New Zealand’s NCSC and Spain’s CNI — published a joint advisory laying out exactly how the tools worked and who they’d been used against.
A company that sold hacking as a service
Integrity Tech isn’t a loose collective of freelance hackers; it’s a registered Chinese firm with government contracts, and according to the DOJ’s press release, it built MicroScan specifically to run reconnaissance against victim networks — identifying exploitable weaknesses at scale before a human operator ever got involved. CISA’s advisory describes MicroScan as a Python-based web application containing more than 1,300 penetration-testing scripts, aimed at widely deployed software including OpenSSL, Oracle WebLogic, Jenkins and WordPress. The advisory traces MicroScan’s use back to 2017, meaning the platform had been in active service for roughly nine years by the time it was seized.
FishHub did the next job in the chain: once MicroScan flagged a weakness, operators used FishHub to run spear-phishing campaigns and deliver malware that gave them remote access or let them pull files directly off a compromised machine. CISA’s advisory also describes a separate capability — a custom web application that “provides third-party access to stolen email content,” where users could pass specific URL arguments to view the contents of specific compromised mailboxes. The advisory doesn’t name who those third parties were, only that the access existed and was built to be shared.
Underneath both tools sat a standard toolkit familiar from any mid-tier intrusion set: BBScan, dirsearch, Fscan, masscan, NMAP and wpscan for scanning; password spraying against Microsoft Exchange servers using a tool called EBurst; cross-site-scripting payloads to harvest credentials; DCSync abuse to pull password hashes out of Active Directory; and SoftEther VPN software installed on compromised hosts for persistent access. CISA’s advisory lists eight specific CVEs the group is confirmed to have exploited for initial access, several of them years old — Bash remote code execution from 2014, a GitLab RCE from 2021, a Strapi information disclosure bug from 2023 — which is less a story about novel exploitation than about how long unpatched, older vulnerabilities keep paying off for whoever bothers to scan for them.
Who got hit
The DOJ press release names confirmed victims across sectors and geography: a power company in South Carolina, a multinational NGO, airports in Japan and Poland, and roughly twenty Taiwanese organizations spanning natural gas, electricity and universities. CISA’s advisory widens that list to US government services and facilities, critical manufacturing, healthcare, information technology, law enforcement, education and religious organizations, plus targets across Southeast Asia and Africa. In some cases, the advisory notes, the attackers restricted access to exfiltrated data to IP addresses originating in Xiamen, China — a detail that reads less like operational security and more like an admission of whose data this ultimately belonged to.
It’s the same sectoral spread — critical infrastructure, government, healthcare — that showed up when a suspected China-nexus actor exploited a five-day-old VMware vCenter patch window to pull off 361 breaches globally earlier this year. Different tooling, different initial-access technique, same pattern: a state-linked actor running infrastructure-as-a-service against whatever unpatched edge it can find, at a scale that individual victim organizations rarely have the visibility to detect on their own.
A second disruption, not the first
This isn’t the US government’s first run at Integrity Tech. BleepingComputer’s reporting notes that federal agencies disrupted a Mirai-based botnet of more than 200,000 devices tied to the company in September 2024 — over a year before this week’s domain seizures. The UK sanctioned Integrity Tech in December 2025, roughly eleven months after the US Treasury’s initial action. The European Union followed with its own sanctions in 2026. None of that stopped MicroScan from staying online: CISA’s advisory confirms the platform was still active as recently as September 2026, a month before the seizure.
Assistant Attorney General John Eisenberg’s statement accompanying the DOJ announcement put the intent plainly: “The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace.” Western District of Pennsylvania US Attorney Troy Rivetti added that the seizures “send another clear message to cybercriminals from the PRC.” Whether a message lands is a different question from whether the infrastructure stays down — Integrity Tech has now absorbed sanctions from three governments and two prior disruption actions, and this is the first one aimed specifically at taking its tools offline rather than its corporate relationships.
The lessons that generalise
Sanctions and takedowns are not the same lever, and neither one is permanent. Three governments sanctioned Integrity Tech across two years before anyone seized the servers running its software. Financial sanctions restrict who can do business with a company; they don’t stop the company’s tools from running. Domain seizures stop the tools from running today, until new domains go up tomorrow. Durable disruption of infrastructure-as-a-service hacking outfits likely requires both, applied repeatedly, not either one applied once.
Old CVEs are still the main door. Eight exploited vulnerabilities, the oldest from 2014, the newest from 2023 — none of them zero-days, all of them patchable years before this advisory. A scanning tool with 1,300 built-in scripts doesn’t need novel exploitation when organizations are still running software vulnerable to bugs over a decade old.
A shared scanning-and-phishing platform means one company’s customer list is a long list of unrelated victims. MicroScan and FishHub weren’t built for a single campaign against a single target; they were general-purpose infrastructure that got pointed at a South Carolina power utility, Taiwanese universities, and Japanese airports alike. Defending against “a sophisticated nation-state actor” and defending against “a company that sells access to a shared scanning platform” call for the same patching discipline, even though they sound like different threat models.
Access-sharing infrastructure is itself a signal worth hunting for. The custom web app that let unnamed third parties query stolen email by URL argument is a reminder that modern intrusion sets increasingly build internal tooling to monetize or redistribute access, not just to use it directly. Detecting that layer requires looking for the infrastructure itself — unusual outbound connections to scanning or exfiltration endpoints — not just for the initial compromise.
Tech-Bee is an independent technology publication. This piece is drawn from the Department of Justice’s press release on the MicroScan and FishHub domain seizures, the joint CISA/FBI/NSA cybersecurity advisory AA26-281A, and reporting by BleepingComputer and The Hacker News.