FBI Seizes Seven Domains Tied to Integrity Tech's MicroScan and FishHub

The FBI seized seven domains on Oct. 8 that ran two hacking tools, MicroScan and FishHub, which the Justice Department says were built by the China-based firm Integrity Technology Group. The same day the FBI, CISA, NSA and agencies in the UK, Australia, Canada, Japan, New Zealand and Spain published advisory AA26-281A, which tells defenders what to hunt for. Its first priority is mundane: identity and access management policies, multifactor authentication on webmail and VPNs, and patching.

The seizures were court-authorized in the U.S. District Court for the Western District of Pennsylvania, CyberScoop reported. The advisory says Integrity Tech is "a China-based company with links to the Chinese government" and that activity it enables matches what the industry calls Flax Typhoon, Ethereal Panda and Red Juliett. The agencies add that not all of the activity may be linked to Integrity Tech.

What MicroScan and FishHub did

MicroScan is a Python web application, in use since 2017, holding more than 1,300 penetration-testing scripts aimed at OpenSSL, Oracle WebLogic, WordPress, Jenkins and Apache Struts, according to the advisory. Per BleepingComputer's reading of the FBI affidavit, it ran alongside a Mirai-based botnet of compromised devices. Two Taiwanese universities were scanned with it in August 2022 and March 2023 and were later breached.

FishHub handled spear-phishing and delivered malware to networks already entered. BleepingComputer says investigators found data from more than 20 organizations on a FishHub-linked server, six of them Taiwanese universities. The Record puts the figure at about 20 universities in Taiwan, so the count differs between outlets and the affidavit is the document to read.

The FBI did not say whether the named power company, airports or energy providers were breached. Reported scan targets include a South Carolina power company, airports in Japan and Poland, and Taiwanese natural gas and electricity companies.

The eight CVEs, and how old they are

The exploited flaws are old. Asterisks in the advisory mark the five that CISA added to its Known Exploited Vulnerabilities catalog as part of this release.

CVE	Product	Newly in KEV
CVE-2014-6278	GNU Bash through 4.3	No
CVE-2015-3306	ProFTPD 1.3.5	Yes
CVE-2015-5477	ISC BIND 9.x before 9.9.7-P2	Yes
CVE-2016-3081	Apache Struts 2.3.19 to 2.3.28	Yes
CVE-2019-11510	Pulse Connect Secure 8.2 to 9.0	No
CVE-2021-22205	GitLab from 11.9	No
CVE-2021-3199	ONLYOFFICE DocumentServer 5.1.5 to 5.6.2	Yes
CVE-2023-22894	Strapi up to 4.5.5	Yes

No new bug is involved: the advisory describes patch lag, not a zero-day. An attacker needs only an internet-facing host running one of these versions. The advisory dates this initial-access activity to at least mid-January 2021.

What the attackers took and how

The advisory lists three data classes: email content from on-premises and cloud systems, account credentials, and Active Directory data including group memberships and trust relationships. Tools include EBurst, a Python password-spraying tool aimed at Microsoft Exchange and Office 365 accounts, and a PHP bot that pulls mail through the Exchange Web Services API. DC.exe performs DCSync, which copies Active Directory data by posing as a domain controller.

Access to some stolen mail was limited to IP addresses in Xiamen, China, the advisory says.

Persistence relied on SoftEther VPN clients renamed conhost.exe or dllhost.exe. One of the seven seized domains, 98aiblog.com, was tied to SoftEther on compromised systems. The advisory warns that several indicators of compromise date back to 2016, so defenders should vet them before blocking.

Who said what

FBI Cyber Division assistant director Brett Leatherman said Integrity Tech "provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning." CISA acting executive assistant director for cybersecurity Chris Butera said Chinese hackers "continue to position themselves within critical infrastructure networks." Neither CyberScoop nor The Record carried a response from Integrity Tech.

The advisory says U.S. targets span government services, critical manufacturing, healthcare and information technology, plus law enforcement, education and religious organizations. Other victims sit in Southeast Asia, Africa and North America. Defenders running perimeter appliances should also read our reports on the F5 BIG-IP APM zero-day and the Cisco SD-WAN Manager zero-day, two other edge-device flaws the site has covered.

BleepingComputer says the Justice Department disrupted an Integrity Tech-operated botnet in September 2024 and reports it at more than 200,000 devices, while The Record gives more than 260,000. Both outlets agree on the year; they do not agree on the count.

The next concrete check is the advisory's Appendix A, which lists file hashes for each tool; hunt there first, before the older indicators.