Seven internet domains that carried a vulnerability scanner and a spear-phishing kit were redirected to FBI-controlled name servers on Oct. 8, 2026, and the bureau says the tools behind them came from a Chinese company, Integrity Technology Group. Court papers unsealed in the Western District of Pennsylvania describe the two tools, MicroScan and FishHub, as instruments for finding and then breaking into networks that ranged from a South Carolina power company to Taiwanese universities.
FBI Cyber Division Assistant Director Brett Leatherman put the supplier relationship in a single sentence: Integrity Tech, he said, gave China-linked hacking crews the means to scan widely and intrude. It is the second time in two years that federal prosecutors in Pittsburgh have gone after the same company.
The seven domains named in the seizure warrant
U.S. Magistrate Judge Maureen P. Kelly signed the seizure warrant on Oct. 6, 2026, and its Attachment A lists seven domains: c0cc.cc, 98aiblog.com, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com and linkedinns.net. The warrant directs the registry operator Verisign to point them at name servers designated by the FBI, which is how a domain is taken out of an operator’s hands without touching the servers behind it.
The Justice Department’s announcement is narrower in what it spells out. It names six: c0cc.cc, which Integrity Tech used to reach MicroScan, and five domains it says helped deliver FishHub malware. The seventh, 98aiblog.com, appears only in the court filings, where the FBI affidavit ties it to a SoftEther remote-administration subdomain that connected two victims’ servers to a single IP address, 108.61.181.104.
Several of the names imitate everyday services. Outlook3650.com, youtubecard.com and linkedinns.net borrow the look of Microsoft, YouTube and LinkedIn, a common way to make a malicious download look routine to the person who receives it.
MicroScan, the Python scanner with 1,300 scripts
MicroScan is a Python-based web application that, according to the joint cybersecurity advisory AA26-281A, has been in use since 2017 and holds more than 1,300 penetration-testing scripts. They probe sites for specific flaws in software such as Apache Struts, WordPress, Jenkins and Oracle WebLogic. Prosecutors say it ran through a botnet of internet-connected devices infected with a variant of the Mirai malware, so the scanning traffic appeared to come from thousands of ordinary gadgets rather than from one source.
The tool’s job was reconnaissance. It mapped weaknesses in victim networks so that Integrity Tech’s customers could return and exploit them. Targets listed by the Justice Department include a power company in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese natural gas and electricity companies, and two Taiwanese universities. The FBI has not said whether the power company, the airports or the energy firms were actually breached; BleepingComputer’s reading of the filings places the two confirmed university intrusions after scans in August 2022 and March 2023.
FishHub and the files sent to Integrity Tech servers
FishHub did the second half of the work. Per the Justice Department, it sent spear-phishing messages to win initial access, then pulled down additional malware that either gave Integrity Tech’s clients remote access or hunted for particular files and sent them to servers the company controlled. Confirmed victims, the department said, included about 20 Taiwanese universities.
The five FishHub domains in the release served as the download points for that second-stage malware, and the affidavit says they also supported the file theft itself. Seizing them cuts the link between an infected machine and its delivery infrastructure, though it does not clean any machine already compromised. The advisory, issued by the FBI, CISA and NSA with agencies from the United Kingdom, Australia, Canada, Japan, New Zealand and Spain, therefore carries indicators of compromise for defenders to hunt for, along with advice to disable unused services, require multifactor authentication on webmail and VPNs, and apply protective DNS.
Integrity Technology Group, Flax Typhoon and the 2024 botnet
The advisory describes Integrity Technology Group as a China-based for-profit company with links to the Chinese government, one that acquires or builds cyber tools, hosts infrastructure and enables others to compromise networks. It also states a limit: the activity it describes is consistent with groups publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett, but those actors may do work unrelated to Integrity Tech, and vendor names do not map one-to-one onto government attribution. The “China-linked” in the allegation is the FBI’s phrase for the customers, not a finding that every intrusion traces to the company.
The company is a repeat subject. In September 2024, the Justice Department announced a court-authorized operation against a Mirai-based botnet that Integrity Tech built and controlled, covering more than 200,000 consumer devices in the United States and abroad. U.S. Attorney Troy Rivetti of the Western District of Pennsylvania called the new seizures the “second disruption of Integrity Tech’s massive operations in as many years.” Assistant Attorney General for National Security John A. Eisenberg said the United States “will not allow China or its proxies to operate against United States interests with impunity in cyberspace.”
The Justice Department release describes seizures of infrastructure rather than arrests. The filings establish the roster of seven domains, with the prosecution led by Assistant U.S. Attorney Brendan McKenna and National Security Division trial attorney Jacques Singer-Emery, and Japan’s National Police Agency assisting.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
