US Seizes Microscan and FishHub Tools Linked to China’s Integrity Tech

The US Justice Department and Federal Bureau of Investigation announced the seizure of two cyber espionage tools, Microscan and FishHub, this week. These tools were operated by Integrity Technology Group, a Beijing-based company with direct government contracts in the People’s Republic of China.

According to court documents unsealed in the Western District of Pennsylvania, malicious actors linked to Integrity Tech used these platforms to scan and breach networks. The tools specifically targeted critical infrastructure systems within the United States and in multiple foreign nations.

Operational Context and History

Assistant US Attorney Troy Rivetti described this action as the Department’s second disruption of Integrity Tech’s massive operations in as many years. Researchers have previously linked Integrity Technology Group to hacking groups known as Flax Typhoon, Ethereal Panda, or RedJuliett. This history indicates that seizing infrastructure does not necessarily halt a group’s activities permanently.

The seized tools were not merely passive scanners. Microscan, accessed via the now-seized domain c0cc.cc, executed over 1,300 penetration testing scripts. These scripts targeted known vulnerabilities in widely used software components, including OpenSSL, WordPress, Jenkins, and Apache Struts, allowing attackers to exploit weaknesses actively.

Scope of the Botnet

Integrity Tech built and operated a botnet composed of infected Internet of Things devices running a variant of Mirai malware. This botnet powered the reconnaissance capabilities of the Microscan tool. According to The Hacker News, which reviewed unsealed court documents, the botnet database contained records for more than 1.2 million infected devices in June 2024.

Of those 1.2 million records, more than 385,000 devices were located in the United States. At the time of the data collection, approximately 260,000 devices were actively infected, with about 126,000 of those active infections situated in the US. The FBI affidavit noted that Microscan had been in active use since at least 2017 and remained reachable through its domain as recently as September 9 of this year.

What should you do?

Security teams should monitor for unauthorized connections to domains associated with Integrity Tech or similar threat actors. Organizations should verify that their IoT devices are not part of known botnets by checking for unusual outbound traffic patterns. Administrators should ensure that systems running OpenSSL, WordPress, Jenkins, and Apache Struts are patched against known vulnerabilities to prevent exploitation by scanning tools.

What to do and how to stay safe: Integrity Technology Group

• Audit IoT device logs for signs of Mirai malware variants or unauthorized outbound connections to suspicious domains.
• Verify that all instances of OpenSSL, WordPress, Jenkins, and Apache Struts are updated to the latest secure versions.
• Monitor network traffic for scanning activity originating from or targeting internal critical infrastructure assets.
• Review firewall rules to block access to known malicious domains and IP addresses associated with Integrity Tech.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tools did the US government seize in this operation?

The Justice Department and FBI seized two hacking tools named Microscan and FishHub, which were used to scan and breach critical infrastructure.

Which company is behind the Microscan and FishHub tools?

The tools were built and run by Integrity Technology Group, a Beijing-based company with contracts with the Chinese government.

How many infected devices were part of the botnet in June 2024?

The botnet database contained records for more than 1.2 million infected devices, with over 385,000 located in the United States.