The FBI has pulled the plug on seven internet domains tied to China-linked hackers, disrupting tools used to hunt for security weaknesses and steal sensitive data from organizations worldwide.
On Oct. 8, the US Department of Justice and FBI announced court-authorized seizures of seven domains associated with China-based Integrity Technology Group. Authorities linked the company’s tools and activity to hackers tracked as Flax Typhoon, which targeted critical infrastructure and other organizations.
The seized infrastructure supported two tools: MicroScan, which searches networks for vulnerabilities, and FishHub, which helps attackers deliver malware through spear-phishing campaigns. The seventh domain, 98aiblog[.]com, supported connections made by SoftEther, legitimate VPN software that investigators say attackers installed on compromised university servers.
According to court documents, MicroScan scans targeted a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and electricity providers, and universities. Investigators confirmed successful intrusions at two Taiwanese universities following scans.
The DOJ said confirmed victims of FishHub activity included approximately 20 Taiwanese universities. The malware could give attackers remote access to victim networks or locate specific files and send them to servers controlled by Integrity Tech.
The FBI seized the domains used to access the tools and distribute malware, cutting off important parts of the operation's infrastructure. However, authorities have not established that every organization whose network was scanned suffered a successful breach.
The list of seized domains is as follows:
- youtubecard[.]com
- c0cc[.]cc
- 98aiblog[.]com
- outlook3650[.]com
- 98aicode[.]com
- linkedinns[.]net
- 98aicai[.]com
A botnet helped hide the attackers
Investigators allege Integrity Tech used a botnet built from internet-connected devices infected with a variant of Mirai malware. The compromised devices helped conduct reconnaissance at scale while obscuring the origin of scanning activity.
MicroScan, a Python-based application containing more than 1,300 penetration-testing scripts, could search for weaknesses in widely used software, including WordPress, Jenkins, Oracle WebLogic and Apache Struts.
The latest action follows a September 2024 disruption of an Integrity Tech-linked botnet that affected more than 200,000 consumer devices worldwide, according to Bleeping Computer.
Why the seizure may not end the threat
The joint advisory describes attackers combining automated vulnerability scanning, credential attacks and legitimate VPN software to compromise networks and maintain access. For defenders, that combination makes it important to investigate both exploited applications and apparently legitimate remote-access activity.
The FBI's domain seizures disrupt access to the identified tools, but they cannot guarantee that compromised systems are clean or that the operators have lost every route into victim networks. Attackers who already installed remote-access software or stole credentials may retain access unless defenders investigate and remove those footholds.
A joint advisory from agencies in the US, UK, Australia, Canada, Japan, New Zealand and Spain provides indicators of compromise to help security teams investigate potential infections. The agencies recommend patching exposed systems, disabling unnecessary services, enforcing multifactor authentication and monitoring for unauthorized remote-access tools and suspicious activity in network logs.
What security teams should check now
Organizations operating critical infrastructure, universities and other potential targets should use the joint advisory to investigate possible compromise. Start with internet-facing applications and remote-access services: identify exposed systems, apply relevant patches and disable services or ports that are not needed.
Review authentication and web application logs for unusual sign-ins, password-spraying activity and exploitation attempts. Check servers and employee devices for unexpected VPN software or other remote-access tools, and confirm that installed software has an authorized business purpose. A legitimate application can still provide an attacker with unauthorized access.
The investigation should extend beyond the seven seized domains. The advisory documents additional indicators, tools and techniques, including activity targeting email accounts and sensitive files. Security teams should combine those indicators with behavioral monitoring and require multifactor authentication wherever possible, particularly for webmail, VPNs and accounts accessing critical systems.
If evidence of compromise emerges, treat it as an incident requiring containment and remediation rather than relying on the domain seizures. Investigate how access was obtained, address exposed vulnerabilities and review potentially compromised accounts and credentials. The practical takeaway is that disrupting external infrastructure does not establish that an organization’s own systems are clean.
Read more: Learn how China-linked hackers turned Cisco routers into covert network gateways and why removing one foothold may leave other routes into an organization’s systems.