U.S. Authorities Dismantle Chinese State-Sponsored Cyber Infrastructure in Landmark Enforcement Action

In a significant escalation of international efforts to curb state-sponsored cyber espionage, the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have executed a coordinated operation to seize seven internet domains used by the China-based “Integrity Technology Group.” This entity, identified by intelligence agencies as a key contractor for Chinese state-sponsored threat actors known as "Flax Typhoon," had been operating a sophisticated digital ecosystem designed to infiltrate critical infrastructure, academic institutions, and government networks globally.

The operation marks a critical point in the ongoing “cat-and-mouse” game between Western cybersecurity agencies and Beijing-linked hacking collectives. By targeting the underlying infrastructure—specifically the platforms used for vulnerability scanning and spear-phishing—U.S. authorities aim to force a significant tactical reset on adversaries who rely on outsourced, private-sector services to conduct large-scale cyber operations.

The Mechanics of the Operation: MicroScan and FishHub

The DOJ’s action centered on two primary platforms: MicroScan and FishHub. These tools served as the backbone for a sprawling campaign that reached from the United States to Southeast Asia, Africa, and Europe.

MicroScan: The Vulnerability Hunter

MicroScan functioned as a high-velocity, Python-based vulnerability scanner. According to FBI court filings, the platform was pre-loaded with over 1,300 penetration-testing scripts. These scripts were engineered to exploit common security weaknesses in widely deployed enterprise software, including Apache Struts, Oracle WebLogic, Jenkins, and various WordPress configurations.

The infrastructure behind MicroScan was particularly aggressive. The group utilized a massive botnet composed of internet-connected consumer devices—many of which had been previously infected with Mirai-variant malware—to mask the origin of the scans. By routing malicious reconnaissance through these compromised "zombie" devices, Integrity Tech could probe networks across the globe while keeping their primary servers shielded from immediate detection.

FishHub: The Spear-Phishing Engine

Once MicroScan identified a target, the threat actors utilized FishHub to gain deeper access. FishHub was specifically designed for large-scale spear-phishing campaigns. It facilitated the delivery of custom malware payloads that granted the attackers remote access to victim networks. Once inside, the malware allowed the operators to conduct granular searches, target specific file types for exfiltration, and establish persistent footholds.

The FBI’s investigation revealed that a single server linked to FishHub contained stolen data and proprietary files belonging to over 20 distinct organizations, including six major universities in Taiwan. The seized domains—including 98aicai.com and linkedinns.net—were used to deliver these malicious payloads, effectively camouflaging the attackers’ activities behind legitimate-looking traffic.

A Chronology of Escalation

The disruption of this infrastructure is the culmination of years of persistent activity by Flax Typhoon and its associates.

• August 2022 – March 2023: During this period, investigators recorded a surge in scanning activity targeting Taiwanese universities. The successful breaches of these institutions served as a "proof of concept" for the effectiveness of the MicroScan platform.
• September 2024: In a previous enforcement action, the DOJ disrupted a massive Integrity Tech-operated Mirai botnet. That operation liberated over 200,000 consumer devices—including IP cameras and routers—that had been hijacked to serve as a launchpad for the group’s scanning operations.
• 2025: The United Kingdom government formally sanctioned Integrity Technology Group, citing the company’s role in reckless and irresponsible cyber activity. This move signaled a growing international consensus that private Chinese firms acting as "cyber-proxies" would face direct financial and legal consequences.
• 2026: The European Union followed suit, placing the company under sanctions. Shortly thereafter, the FBI successfully mapped and seized the seven domains currently linked to the MicroScan and FishHub platforms, effectively severing the command-and-control (C2) link for the current campaign.

The Strategic Implications: Outsourced Espionage

The FBI’s assessment of Integrity Technology Group highlights a nuanced shift in how the Chinese government conducts cyber espionage. According to Brett Leatherman, Assistant Director of the FBI’s Cyber Division, the Chinese state increasingly relies on private-sector contractors to provide the "heavy lifting" for cyber operations.

"Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure," Leatherman stated.

This model offers the Chinese government a degree of plausible deniability, allowing state-sponsored actors to utilize tools developed by private firms while maintaining a buffer between the military/intelligence apparatus and the actual keyboard operators. By disrupting these private contractors, the FBI is not just taking down a single set of domains; it is increasing the "cost of business" for Beijing. When a contractor’s infrastructure is seized, their tools are burned, their client data is exposed to law enforcement, and their credibility with their state sponsors is damaged.

Scope of the Threat: Who Was Targeted?

While the FBI has not publicly confirmed the breach status of every individual organization identified in the seizure affidavits, the scope of the reconnaissance was global and alarming. The target list included:

• Critical Infrastructure: Power companies in South Carolina, as well as energy providers and natural gas companies in Taiwan.
• Transportation Hubs: Airports in Japan and Poland.
• Academic Institutions: Universities in Taiwan and elsewhere, often targeted for their research into dual-use technologies.
• Governmental/Public Sector: Agencies in the United States, as well as religious organizations, healthcare providers, and law enforcement entities across North America, Southeast Asia, and Africa.

The attackers’ methodology was comprehensive. They did not merely "land and expand." They utilized specialized tools like the open-source EBurst to conduct password-spraying attacks against Microsoft Exchange servers, allowing them to siphon emails and steal Active Directory credentials. They even developed a custom web application that allowed their operators to browse stolen emails in a searchable, user-friendly interface, suggesting a highly organized, professionalized operation rather than a loose collection of hackers.

Official Responses and Defensive Guidance

In conjunction with the seizures, the FBI, CISA, and the NSA—along with international intelligence partners—issued a comprehensive joint cybersecurity advisory. The advisory serves as a roadmap for organizations to purge their networks of Flax Typhoon influence.

Key Recommendations for Organizations:

1. Review Indicators of Compromise (IOCs): Organizations are urged to compare their network logs against the IP addresses, domain names, and malware hashes provided in the joint advisory.
2. Patching Cadence: Given that the attackers targeted known vulnerabilities in Oracle WebLogic, Apache Struts, and others, agencies emphasize the importance of immediate patching of external-facing applications.
3. Authentication Protocols: The use of password spraying underscores the critical need for robust, phishing-resistant multifactor authentication (MFA).
4. Network Hygiene: Organizations should audit their networks for unnecessary exposed services. The attackers frequently leveraged SoftEther VPN software to maintain persistent access; identifying and removing unauthorized VPN instances is a priority.

The Road Ahead

The seizure of these seven domains is a temporary victory in a long-term conflict. Cybersecurity experts warn that actors like Flax Typhoon—and the companies that serve them—are resilient. They frequently rotate their infrastructure, re-register domains, and adapt their malware to evade signature-based detection.

However, the cumulative pressure of international sanctions from the UK, EU, and the U.S. DOJ is beginning to take a toll. By linking these cyber operations directly to the corporate entities facilitating them, Western governments are attempting to shift the paradigm from defensive "patch-and-pray" strategies to offensive disruption.

As cyber-speed attacks become the new standard—often aided by AI-driven reconnaissance—the ability to identify and neutralize the underlying infrastructure of the attacker is more important than ever. The message from the FBI is clear: if you provide the tools for state-sponsored digital intrusion, your infrastructure will be dismantled, your operations will be exposed, and your ability to conduct business will be curtailed.

The battle for digital sovereignty continues, but with the takedown of the MicroScan and FishHub platforms, the U.S. has once again demonstrated that the digital "safe havens" for state-sponsored cyber contractors are shrinking rapidly.