The U.S. Justice Department has seized multiple websites that supported two hacking tools built by Beijing-based Integrity Technology Group, a company U.S. and allied officials link to the Chinese state hacking campaign known as Flax Typhoon, The Record reported Thursday. The court-authorized action came alongside a joint technical advisory from cybersecurity and intelligence agencies in seven countries.

What Happened

The seized sites supported Microscan, an automated reconnaissance and vulnerability scanning tool used since 2017, and FishHub, a phishing platform used to deliver malware and set up remote access after a target is compromised. The Associated Press reported that the action rendered both tools inoperable. Officials did not say how many domains were taken down.

The joint advisory, AA26-281A, was issued by the FBI, CISA and NSA with the U.K.'s National Cyber Security Centre, Australia's ASD's ACSC, the Canadian Centre for Cyber Security, Japan's National Police Agency and National Cybersecurity Office, New Zealand's NCSC and Spain's Centro Nacional de Inteligencia. It describes Integrity Tech as a for-profit company with Chinese government ties that supplies tools, infrastructure and personnel for intrusions worldwide. The Record reported that the company works under contract for China's Ministry of State Security.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

According to the advisory, Microscan is a Python-based web application holding more than 1,300 penetration-testing scripts. The document also details EBurst, which runs password-spraying attacks against Microsoft Exchange, a tool that performs DCSync attacks to pull credentials from Active Directory, SoftEther VPN installers disguised as conhost.exe or dllhost.exe, and a command-line utility that automates theft of Outlook 365 email. Access to some of the stolen-mail infrastructure was restricted to IP addresses in Xiamen, China.

Who Was Hit

The Record and the AP said victims included a power company in South Carolina, airports in Japan and Poland, Taiwanese natural gas and power companies, about 20 Taiwanese universities and a multinational nongovernmental organization. The advisory also lists government, law enforcement, health care and religious organizations, with victims in Southeast Asia, Africa and North America.

The advisory names eight vulnerabilities the group exploited, including a 2014 GNU Bash flaw and bugs in ISC BIND, ProFTPD, Apache Struts, Pulse Connect Secure, GitLab, ONLYOFFICE DocumentServer and Strapi.

Why It Matters

Officials framed the case as an attack on the business model behind Chinese state hacking rather than on a single team. FBI Assistant Director Brett Leatherman said Beijing relies on contractors and enabling companies to expand the reach and scale of its operations. Jason Bilnoski, a deputy assistant director in the FBI's Cyber Division, told the AP that the bureau aims to strip the actors of their infrastructure, money and tools.

CISA's acting executive assistant director for cybersecurity, Chris Butera, said Chinese government-affiliated actors keep positioning themselves inside critical infrastructure, including operational technology, so they can disrupt it at a future time of their choosing. The U.K. NCSC's Paul Chichester said the "breadth of sectors" targeted showed the extent of the threat.

Large transformer at an electrical substation
Illustrative photo: Unsplash. Not a photograph of the reported event.

Context

This is the second major U.S. action against Integrity Tech's infrastructure. In September 2024, the Justice Department disrupted a Mirai-based botnet run by the company that had enlisted more than 260,000 cameras, video recorders and routers, according to The Record. The company has also been sanctioned by the U.S. Treasury. The Record reported that Integrity Tech was founded in 2010 by Chinese hacker Cai Jingjing.

The advisory notes that security vendors track overlapping activity under names including Flax Typhoon, Ethereal Panda and Red Juliett, and the AP said the 58-page document covers roughly six years of activity.

What to Watch

An FBI agent told the AP the bureau will watch whether Integrity Tech tries to rebuild its infrastructure. The advisory asks network defenders to hunt for its indicators, enable multifactor authentication, patch the listed vulnerabilities and secure their edge infrastructure.