US Authorities Disrupt Cyber Tools Linked to China-Associated Hacking Operations

The United States Department of Justice and the Federal Bureau of Investigation (FBI) have seized digital infrastructure used by cyber actors allegedly associated with Integrity Technology Group, a China-based company linked by US authorities to hacking operations known as Flax Typhoon. The operation targeted two tools, Microscan and FishHub, which investigators say were used to identify vulnerable computer networks and facilitate unauthorised access.

According to court documents, Microscan was designed to scan computer systems for security weaknesses that could subsequently be exploited. The tool reportedly operated through a network of internet-connected devices infected with a variant of Mirai malware. The targeted systems included a US power company, airports in Japan and Poland, Taiwanese energy infrastructure companies and universities.

The second tool, FishHub, was allegedly used in spear-phishing operations. These attacks rely on deceptive messages tailored to particular individuals or organisations to encourage victims to reveal information or open malicious content. Investigators say FishHub helped deliver additional malware, enabling remote access to compromised networks and the collection of selected files.

Authorities announced court-authorised seizures involving seven domains to disrupt access to the tools and the infrastructure supporting their operations. The FBI and international partners also released a cybersecurity advisory containing technical information intended to help network defenders identify possible compromises and strengthen their systems.

The action follows an earlier disruption in September 2024, when US authorities targeted a Mirai-based botnet associated with the same operation. That network had reportedly infected more than 200,000 consumer devices worldwide.

The allegations form part of an ongoing investigation. US agencies have urged organisations, particularly those operating critical infrastructure, to review the advisory, check for indicators of compromise and address known vulnerabilities in exposed systems.

08-10-2026