SecOraLens
CriticalPhishing

FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers

Cyber Security News·Source published ·1 min read

What happened?

The FBI and U.S. Justice Department have seized seven domains tied to Microscan and FishHub, two hacking tools allegedly operated by China-based Integrity Technology Group. Announced on October 8, 2026, the court-authorized action aims to cut access to systems used to scan critical infrastructure, support spear phishing, and steal files from compromised networks. Court documents unsealed in the Western District of Pennsylvania link the activity to Flax Typhoon, a hacking group tracked by security researchers.

Key details

  • FBI seized seven domains tied to Microscan and FishHub hacking tools linked to China-based Integrity Technology Group
  • FishHub supported spear phishing attacks and downloaded additional malware after initial foothold, providing remote network access or file transfer capabilities
  • Five seized domains supported malware delivery: 98aicai[.]com, 98aicode[.]com, linkedinns[.]net, outlook3650[.]com, and youtubecard[.]com
  • One seized domain 98aiblog[.]com was tied to SoftEther VPN software used to maintain unauthorized remote access

Affected

  • Microscan and FishHub hacking tools allegedly operated by China-based Integrity Technology Group
  • Internet-connected devices infected with Mirai malware variant used as botnet by Integrity Tech
  • Targets of Microscan scans included power company in South Carolina, airports in Japan and Poland, natural gas and power companies in Taiwan, a multinational NGO, and two universities in Taiwan
  • Approximately 20 Taiwanese universities confirmed as FishHub victims

Fixes and mitigations

  1. Agencies recommend patching exposed systems, disabling unused services, requiring multifactor authentication, and reviewing cloud applications with access to sensitive data
  2. Agencies urge monitoring for unexpected VPN installations, unusual account activity, and large outbound transfers

What to look for

  • VPN-based persistence and automated email theft observed by investigators
  • Defenders should compare historical DNS, proxy, firewall, and endpoint logs against published indicators

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories