The US Justice Department and FBI have seized seven internet domains in an operation designed to disrupt cyber tools allegedly operated by actors working for China-based Integrity Technology Group.
US authorities associate the activity with the hacking operation known in the private sector as Flax Typhoon. China’s foreign ministry said it opposes hacking and what it described as the malicious spread of misinformation.
What was disrupted
According to court documents described by the Justice Department, the domains supported two tools named Microscan and FishHub, as well as unauthorised remote-administration software.
Microscan was allegedly used to identify vulnerabilities in target networks, including through a botnet of internet-connected devices infected with a Mirai malware variant. The Justice Department said scanning targets included a US power company, Japanese and Polish airports, Taiwanese energy infrastructure, universities and a multinational non-governmental organisation.
FishHub allegedly supported spear-phishing operations. After an initial compromise, it could deliver additional malware that enabled remote access or searched for selected files and sent them to attacker-controlled servers. Authorities linked confirmed FishHub activity to about 20 Taiwanese universities.
Why domain seizures matter
A domain seizure does not remove every compromised device or eliminate the people behind an operation. It can nevertheless deny access to command, delivery or administration infrastructure, interrupt active campaigns and expose technical indicators that help defenders identify related activity.
This is the second publicly announced US disruption of infrastructure attributed to Integrity Tech. A 2024 operation targeted a botnet comprising more than 200,000 compromised consumer devices worldwide, according to the Justice Department.
The repeated action highlights a change in cyber defence. Governments are increasingly combining indictments and diplomatic attribution with court orders, infrastructure seizures, malware disruption and public technical advisories. The goal is to impose immediate operational costs rather than wait for criminal suspects to become available for arrest.
What defenders should learn
The campaign joined several stages of intrusion: large-scale scanning, targeted phishing, malware delivery and persistent remote access. Defending against only one stage leaves other routes open.
Organisations should use the accompanying FBI indicators to search logs and systems, but indicators are only a starting point. Asset inventories, rapid patching of exposed services, phishing-resistant authentication, restricted administrative tools and segmentation between user networks and critical systems can reduce the value of both scanning and stolen credentials.
The operation also demonstrates why consumer and small-business devices matter to national cybersecurity. Poorly secured routers and connected equipment can be recruited into infrastructure that obscures the source of scanning and attacks against much larger targets.