The Justice Department and FBI seized two hacking tools tied to the Chinese government-linked group Flax Typhoon and the China-based firm Integrity Technology Group, and the FBI, CISA, and NSA issued a joint advisory alongside the announcement.

 

What happened

On Thursday, the FBI and DOJ announced that they had seized the domain names, or web addresses, for two hacking tools created by Integrity Technology Group. The first, Microscan, which is a vulnerability scanning tool. It automatically searches networks for security weaknesses that attackers can exploit. The second, FishHub, is a spearphishing tool. Spearphishing means sending a targeted, deceptive email to trick a specific person into clicking a malicious link or opening a harmful file. Seizing the domains blocks hackers from reaching both tools.

Authorities obtained court-authorized seizures in the Western District of Pennsylvania, a federal court district. They also unsealed documents in the case on Thursday, which made the court records public.

Law enforcement said Integrity Tech used a Mirai-variant botnet to run Microscan. A botnet is a network of hijacked devices that attackers control remotely. Mirai is a known type of botnet malware, and a variant is a modified version of it. This botnet used internet-of-things devices, meaning everyday internet-connected hardware such as cameras and routers.

Microscan targets have included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and universities in Taiwan, and others. FishHub installs malware on a victim’s network after attackers get in through spearphishing. Its victims include Taiwanese universities.

 

The backstory

The U.S. government has taken repeated action against Integrity Technology Group. It sanctioned the company last year. In 2024, it made the company the focus of a takedown operation, saying the company was behind a massive botnet.

Healthcare leaders had already received a warning. In April 2026, the American Hospital Association (AHA) warned that Chinese cyber threat networks, including Flax Typhoon, have exposed health systems to espionage and possible disruption.

 

Going deeper

The advisory describes how Chinese government-linked threat actors combine several methods:

  • Automated scanning tools
  • Large-scale botnets
  • Hands-on exploitation techniques
  • Cross-site scripting attacks and password spraying on Microsoft Exchange servers
  • Persistence through VPN software
  • Scripts that exfiltrate emails and credentials

 

What was said

The joint advisory states that Chinese government-linked actors, enabled by Integrity Technology Group, combine scanning tools, botnets, and hands-on exploitation to “target and steal sensitive data from organizations worldwide, including U.S. critical infrastructure sectors.”

Chris Butera, acting executive assistant director for cybersecurity at CISA, said Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems. Their aim is “disrupting critical functions at a future time of their choosing.”

Brett Leatherman, head of the FBI’s Cyber Division, said the FBI pursues both the actors who threaten critical infrastructure and “the enterprises that support them.” He said Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises. According to Leatherman, it acquires or develops cyber tools and hosts infrastructure for actors targeting networks worldwide.

 

Why it matters

Riggi said Flax Typhoon-style campaigns have exposed health systems, which count as critical infrastructure. Hospitals also hold sensitive patient data, which makes them attractive espionage targets.

The advisory’s methods match what hospitals run every day. Attackers password spray Microsoft Exchange servers, persist through VPN software, and steal emails and credentials. These systems support clinical communication and remote access, and the AHA says remote work has widened the attack surface.

Integrity Tech has already faced sanctions and a botnet takedown, so this latest seizure suggests the company keeps developing new tools after each enforcement action.

 

The bottom line

The seizures take two tools away from Flax Typhoon-linked hackers, but the advisory makes clear the broader campaign continues. Healthcare organizations should review the joint FBI, CISA, and NSA advisory and check their Microsoft Exchange servers, VPN software, and password practices for the weaknesses it describes.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a cross-site scripting attack?

A cross-site scripting attack happens when hackers inject malicious code into a trusted website so it runs in the browsers of people who visit the site.

 

What is operational technology (OT)?

Operational technology is the hardware and software that monitors and controls physical equipment, such as power systems, machinery, and building controls.

 

What does it mean when hackers “establish persistence”?

Establishing persistence means an attacker sets up a way to keep access to a network even after a device restarts or the original entry point is closed.

 

Why does the government seize domain names?

Seizing a domain name cuts hackers off from the web address their tools run on, so they can no longer reach or operate them from that address.