FBI seizes tools used against critical infrastructure, DOJ says

The court-authorized action targeted Microscan and FishHub, which U.S. authorities link to China-based Integrity Technology Group. Britain and international partners issued a parallel warning.

The Justice Department and FBI announced court-authorized seizures on 8 October aimed at denying access to two hacking tools, Microscan and FishHub. DOJ said the tools had been used to scan and, in some cases, penetrate American and overseas critical infrastructure and other networks.

Court documents described by DOJ link the tools to Integrity Technology Group in China. The department said Microscan’s targets included a South Carolina power company, airports in Japan and Poland, and Taiwanese energy companies. It described approximately 20 Taiwanese universities as confirmed victims of FishHub activity.

Britain’s National Cyber Security Centre issued a joint advisory the same day, warning that actors enabled by Integrity Tech combined automated scanning, botnets and manual exploitation to steal sensitive information. The NCSC said the activity was consistent with campaigns publicly known as Flax Typhoon, Ethereal Panda and Red Juliett.

The action followed the September 2024 disruption of an Integrity Tech botnet that DOJ said contained more than 200,000 consumer devices. The new international advisory was co-signed by the NCSC and agencies from Australia, Canada, Japan, New Zealand, Spain and the United States.

Attribution and victim counts come from official accounts. The DOJ and NCSC releases accompany coordinated enforcement and advisory activity, so they do not constitute independent corroboration. The extent to which the seizures prevent future intrusions remains unestablished here.