Integrity Technology Group was named by the Justice Department and FBI on Tuesday as the PRC-linked contractor behind two hacking tools, with authorities announcing court-authorized seizures designed to cut off access to “Microscan” and “FishHub.” According to court filings unsealed in the Western District of Pennsylvania, the tools were used to scan and, in some instances, penetrate U.S. and foreign critical infrastructure and other networks. Officials said Integrity Technology Group, a People’s Republic of China contractor, operated and used the tools and holds contracts with the PRC government.
Assistant Attorney General for National Security John A. Eisenberg said the United States will not permit China or its proxies to act with impunity in cyberspace and pledged continued action to disrupt Flax Typhoon threats and protect critical networks. U.S. Attorney Troy Rivetti for the Western District of Pennsylvania said the seizures mark a second disruption of Integrity Technology Group’s operations in as many years, underscoring the department’s commitment to cybersecurity. FBI Cyber Division Assistant Director Brett Leatherman said the PRC depends on contractors and enabling companies to expand malicious cyber activity and that exposing such enablers makes it harder to target American systems. FBI San Diego Special Agent in Charge Mark Remily said the bureau will continue to use its full investigative authority to defend critical infrastructure and national security.
Integrity Technology Group’s tools and targeted victims
Court documents state that Integrity Technology Group built and leveraged a botnet of internet-of-things devices infected with a Mirai malware variant to power vulnerability scanning through Microscan. The company developed Microscan to conduct reconnaissance on victim networks for weaknesses that clients later exploited. Targets of Microscan scanning included a U.S. power company based in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese critical infrastructure firms in the natural gas and power sectors, and two Taiwanese universities. Investigators said Microscan was accessed through the seized domain c0cc[.]cc.
A second tool, FishHub, allegedly enabled spear phishing campaigns. Following initial compromises, FishHub delivered additional malware that granted unauthorized remote access or searched for and exfiltrated targeted files to servers controlled by Integrity Technology Group. Confirmed victims included about 20 Taiwanese universities. Five seized domains were used to deliver the malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.
Integrity Technology Group disruption and ongoing investigation
Officials said this is the department’s second public technical disruption of Integrity Technology Group’s infrastructure. In September 2024, authorities announced a court-approved operation that disrupted the group’s Mirai botnet composed of more than 200,000 consumer devices in the United States and abroad. Alongside the latest seizures, the FBI and domestic and international partners issued a cybersecurity advisory with indicators of compromise linked to the group’s activity to help defenders detect and respond.
The investigation is being led by the FBI’s San Diego and Baltimore Field Offices in coordination with the FBI’s Cyber Division. The case is being prosecuted by Assistant U.S. Attorney Brendan McKenna for the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery of the National Security Division’s National Security Cyber Section, with assistance from Assistant U.S. Attorney Thomas Sullivan for the District of Maryland and Japan’s National Police Agency.
Officials noted that the affidavit and seizure warrant are available for public viewing.