How US Disruption of Integrity Tech Tools Impacts Global Infrastructure Security

The US Department of Justice and FBI executed court-authorized seizures of two hacking tools, Microscan and FishHub, this week. These tools were operated by Integrity Technology Group, a Beijing-based company holding direct contracts with the Chinese government. The operation aimed to deny malicious actors access to infrastructure used for scanning and breaching critical systems in the US and abroad.

Root cause

Integrity Technology Group built and maintained these tools to support cyber espionage activities. Researchers have linked the company to hacking groups known as Flax Typhoon, Ethereal Panda, and RedJuliett. Assistant US Attorney Troy Rivetti noted this marks the second disruption of the group’s operations in two years. The seizures highlight that taking down specific infrastructure does not necessarily halt the broader activities of such entities permanently.

Attack path

Microscan operated via the domain c0cc.cc and executed over 1,300 penetration testing scripts. These scripts targeted known vulnerabilities in software including OpenSSL, WordPress, Jenkins, and Apache Struts. The FBI affidavit states the tool was actively used from at least 2017 through September 9 of this year. The tool facilitated reconnaissance and, in many cases, successful intrusions into critical infrastructure networks across multiple nations.

Affected versions

The source material does not specify exact software versions affected by the scans. However, the tools targeted known weaknesses in widely used platforms:

• OpenSSL
• WordPress
• Jenkins
• Apache Struts
• Various IoT devices running Mirai malware variants

Mitigation

The source material does not provide specific vendor patches for the exploited vulnerabilities. Organizations should monitor for unusual scanning activity from the seized domains. Security teams should verify that their critical infrastructure components are not communicating with known malicious infrastructure. No confirmed fix exists for the specific tooling seized, though standard vulnerability management applies to the targeted software.

Background: Cyber espionage

Use this checklist to harden identity controls, limit internal movement, and detect silent data exfiltration. Focus on service accounts, network segmentation, and behavioral baselines. These steps address the specific mechanics of long-term espionage rather than generic malware threats.

Read the full guide: Cyber Espionage Prevention Checklist: Stop Silent Data Theft

What to do and how to stay safe: Integrity Technology Group

• Audit external-facing assets for signs of scanning activity targeting OpenSSL, WordPress, Jenkins, or Apache Struts.
• Review IoT device security configurations to ensure they are not part of known botnets or infected with Mirai variants.
• Monitor network logs for connections to domains historically associated with Integrity Technology Group operations.
• Ensure critical infrastructure systems are isolated from general internet-facing networks where possible.

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who operated the seized hacking tools?

Integrity Technology Group, a Beijing-based company with Chinese government contracts, operated Microscan and FishHub.

What was the scale of the associated botnet?

The botnet database held records for over 1.2 million infected devices in June 2024, including 385,000 in the US.

When was Microscan last known to be active?

The tool was reachable through its domain as recently as September 9 of this year, according to court documents.