U.S. authorities have seized internet infrastructure connected to two hacking platforms allegedly operated by China-based Integrity Technology Group, disrupting tools used to scan critical infrastructure and support spear-phishing attacks.
The Justice Department and FBI obtained court authorization to seize seven domains linked to tools called Microscan and FishHub, which authorities say were operated by actors associated with the hacking group commonly known as Flax Typhoon.
Reuters reported that the action is intended to disrupt infrastructure allegedly used by Chinese hackers to target networks in the United States and abroad.
Microscan turned vulnerability discovery into infrastructure
According to court documents described by the Justice Department, Microscan was built to conduct reconnaissance on victim networks and identify vulnerabilities that could later be exploited.
Targets of its scanning included a South Carolina power company, Japanese and Polish airports, Taiwanese energy infrastructure, universities and an international NGO.
The tool was also connected to a botnet of internet-connected devices infected with a variant of Mirai malware.
ITPro reported that Microscan contained more than 1,300 penetration-testing scripts, allowing operators to automate discovery of weaknesses across large numbers of systems.
That automation matters because reconnaissance is usually one of the most resource-intensive parts of an attack campaign.
FishHub handled the next stage of intrusion
The second platform, FishHub, allegedly supported spear-phishing operations after attackers had identified potential targets.
The Justice Department said FishHub could download additional malware following an initial compromise. That malware could provide unauthorized remote access or search victim machines for particular files before sending them to attacker-controlled infrastructure.
Confirmed FishHub victims included approximately 20 universities in Taiwan.
Five of the seized domains were allegedly used to deliver malware associated with the platform.
This is the second disruption tied to Integrity Tech
The latest operation follows a much larger intervention in 2024.
That earlier action dismantled an Integrity Tec2013h-linked Mirai botnet made up of more than 200,000 compromised consumer devices worldwide.
The FBI now says Chinese government-linked actors associated with Integrity Tech combine automated scanning, large-scale botnets and hands-on exploitation when targeting organizations.
China has repeatedly rejected U.S. accusations that it sponsors malicious hacking activity, while Reuters reported that the Chinese Embassy in Washington again disputed the allegations surrounding Integrity Tech.
State-backed hacking is becoming a platform business
For cybersecurity teams, the larger lesson is architectural.
Sophisticated campaigns increasingly look less like individual hackers manually probing targets and more like software operations supported by scanning platforms, botnets, phishing infrastructure and reusable exploit libraries.
That lets a relatively small number of operators search enormous portions of the internet for exposed systems.
Disrupting one hacker account therefore matters less than disabling the infrastructure that allows attacks to scale.
The Flax Typhoon operation demonstrates that the cybersecurity contest is increasingly about taking platforms away from attackers—not simply identifying the people operating them.
