Seven domain names are now evidence instead of infrastructure. On October 8, the United States Justice Department and FBI announced court-authorized seizures intended to cut access to Microscan and FishHub, two systems that officials allege were operated by the China-based Integrity Technology Group and used in activity commonly tracked as Flax Typhoon.
Microscan was reconnaissance machinery. According to the unsealed court record summarized by the Justice Department, it worked through a network of internet-connected devices infected with Mirai malware to scan potential targets for vulnerabilities. The listed targets crossed the usual border between digital and physical systems: a United States power company, airports in Japan and Poland, Taiwanese energy companies, universities and a multinational nonprofit.
FishHub handled a later stage. Officials say it supported spear-phishing campaigns and delivered additional malware after an initial compromise. That software could provide remote access or search for selected files and send them to attacker-controlled infrastructure. The seizure removed access through seven domains. It did not erase the knowledge, personnel or incentives that assembled the system.
This is the second publicly described technical disruption of Integrity Tech infrastructure. A 2024 operation dismantled a Mirai botnet comprising more than 200,000 consumer devices. The recurrence is the useful signal: an intrusion campaign is not merely malicious code. It is a production system made of contractors, domain registrations, compromised routers, scanners, phishing services and customers. Remove one dependency and the system must reorganize.
For defenders, the accompanying indicators of compromise matter more than the geopolitical label. Domain seizures buy time and visibility. Durable defense still requires finding the activity already inside networks, replacing exposed credentials and reducing the number of edge devices that can quietly become somebody else’s infrastructure.
Public source ledger