The Justice Department took seven domains on October 8. A joint advisory the same day detailed password attacks on Microsoft email accounts.

 

What happened

The Justice Department and FBI seized seven internet domains supporting two hacking tools, Microscan and FishHub, the department announced on October 8, 2026. Court documents unsealed in the Western District of Pennsylvania allege the tools were run by Integrity Technology Group, a company in China with contracts with the Chinese government. Its activity is tracked in the security industry as Flax Typhoon. Microscan scanned networks for weaknesses that the company's clients could later exploit. Its targets included a US power company in South Carolina, an international non-governmental organization, and airports. FishHub supported spear phishing, which means phishing emails written for a specific person or organization.

 

Going deeper

FishHub's work started after someone fell for a phishing email. It downloaded more malware onto the victim's network, according to the Justice Department. That malware either gave the company's clients remote access or searched for specific files and sent them to its servers. About 20 universities were confirmed victims. A seventh seized domain was tied to unauthorized remote administration software, used to connect victims' networks to a company server. Microscan relied on a botnet, a network of hijacked internet-connected devices. These were infected with a variant of the Mirai malware. The company reached Microscan through one of the seized domains.

 

What was said

"These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims' vulnerabilities," said US Attorney Troy Rivetti for the Western District of Pennsylvania, in the announcement. Brett Leatherman, Assistant Director of the FBI's Cyber Division, said the company "provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure."

 

In the know

A joint advisory published the same day describes how the actors broke into email accounts, in advisory AA26-281A. The FBI led it with CISA, the NSA, and agencies in six other countries. The actors used EBurst, a free open-source tool, against Microsoft Exchange and Microsoft 365 accounts. It tries passwords through several different Exchange login routes, including Outlook Web Access and Exchange Web Services. The technique is called password spraying. It tries a few common passwords across many accounts instead of many passwords against one, which helps it avoid account lockouts. This was the Justice Department's second public disruption of the company. The first, in September 2024, took down a botnet of more than 200,000 consumer devices, Cyber Security News reported.

 

The big picture

Password spraying goes after the email accounts healthcare staff use every day, and it works because the attempts are spread thin enough to look like ordinary failed logins. The agencies recommend patching exposed systems, switching off unused services, and requiring multifactor authentication, according to Cyber Security News' account of the advisory. They also advise reviewing cloud applications that can reach sensitive data. Defenders should watch for unexpected VPN installations, unusual account activity, and large outbound data transfers. For a hospital, a compromised mailbox means more than lost mail. It can hold referral letters, lab results, and billing correspondence, so a sprayed password can become a breach without any malware involved. Exchange login logs are the place to look for the pattern, since many failed sign-ins spread across many accounts from one source are the signature.

 

FAQs

What is password spraying?

Trying a small number of common passwords against many accounts, rather than many passwords against one. It avoids the lockouts that would trigger after too many failures on a single account.

 

Does multifactor authentication stop it?

It stops a correct password from being enough on its own. Older Exchange login routes that don't support multifactor authentication are the gap attackers look for, so those should be disabled where they aren't needed.

 

What is a domain seizure?

A court order lets law enforcement take control of web addresses. Anyone visiting them sees a seizure notice instead, which cuts off access to whatever the domain was running.

 

Does seizing domains stop the operation?

It disrupts it, the company can set up new infrastructure, which is why this was the second action against the same operation in two years.

 

What should an organization check in its email logs?

Look for many failed sign-ins across many accounts from the same source, sign-ins through older protocols, and new mailbox rules or forwarding addresses. Any of these can point to a sprayed account being used.