This is a domain-infrastructure disruption, not a roundup of the people involved. The allegations come from court documents. They are not a finding of guilt.
What was seized
The seven domains, as listed by the DOJ and BleepingComputer, break down by role:
| Role | Domains |
|---|---|
| MicroScan access | c0cc.cc |
| FishHub malware delivery | 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net |
| SoftEther remote-access tie-in | 98aiblog.com |
Integrity Tech reached MicroScan through c0cc.cc. The seizures came with a cybersecurity advisory published by the FBI and other US and foreign-partner agencies. BleepingComputer reports that the seized domains now show FBI seizure notices naming Flax Typhoon and Integrity Tech.
The delivery domains deserve a second look from anyone running mail security. Names like outlook3650 and linkedinns are classic lookalikes, designed to survive a quick glance at a link in a phishing message. A search of mail and proxy logs for these strings is cheap and quick.
MicroScan: scanning versus breaching
The DOJ says Integrity Tech built MicroScan to scout victim networks for weaknesses that its clients could exploit later. A botnet of IoT devices infected with a Mirai variant helped with the scanning. Scanning through infected devices can make the traffic look like it comes from ordinary consumer gear rather than from the operators.
Scanned targets included a South Carolina power company, a multinational NGO, Japanese and Polish airports, Taiwanese natural gas and power companies, and two Taiwanese universities. This list is easy to misread. BleepingComputer reports that the affidavit confirms breaches at the two Taiwanese universities, which were scanned in August 2022 and March 2023. The FBI did not say whether the named power companies, airports and energy providers were actually breached. The headline phrase "breach critical infrastructure" is therefore broader than what the public filings show for those named targets. The DOJ's own wording is "scan and, in some cases, hack."
FishHub: phishing, then payloads
After an initial compromise, FishHub downloaded more malware to the victim network. That malware gave remote access or searched for specific files and sent them to servers controlled by Integrity Tech. The DOJ says confirmed FishHub victims included approximately 20 Taiwanese universities.
There is a counting wrinkle. BleepingComputer, citing the affidavit, says investigators found files from more than 20 organizations on a FishHub-linked server, including six Taiwanese universities. That is not the same statement as the DOJ's "approximately 20 universities". The two figures describe different things, so treat them as separate claims.
BleepingComputer also says the seventh domain, 98aiblog.com, was tied to SoftEther VPN software installed on compromised systems. SoftEther is legitimate software, which is the point. Unauthorized remote-access tools are hard to spot because the binaries are not inherently malicious. Reviewing unexpected installs of any remote-administration software is a sensible check.
What the advisory reportedly adds
BleepingComputer's summary of the joint FBI, CISA and NSA advisory includes several details I could not confirm independently here. The DOJ release only says the advisory provides indicators of compromise. The Record describes it as a 58-page document covering tools Chinese actors have used over about six years. The following comes from BleepingComputer's account of the advisory:
- MicroScan is a Python-based scanner with more than 1,300 scripts. They target software such as Oracle WebLogic, Apache Struts, WordPress and Jenkins.
- Eight commonly targeted vulnerabilities were named. They include ProFTPD (CVE-2015-3306), Apache Struts (CVE-2016-3081), Shellshock (CVE-2014-6278), Pulse Secure VPN (CVE-2019-11510) and GitLab (CVE-2021-22205). The rest are in ISC BIND, ONLYOFFICE DocumentServer and Strapi.
- The actors used the open-source EBurst tool for password spraying against Microsoft Exchange servers. They also used other tools to steal email and collect Active Directory credentials.
- The FBI reportedly found a custom web app that let third parties browse stolen mail without access to the compromised accounts.
- The activity overlaps with groups tracked as Flax Typhoon, Ethereal Panda and Red Juliett, though not all of it is necessarily tied to Integrity Tech.
These CVEs are mostly old. That is useful context. Long-running campaigns often rely on unpatched, internet-facing systems rather than fresh zero-days. Most of the named software is not Windows-specific, but Exchange and Active Directory are where Windows shops are exposed.
Practical steps for admins
Apart from the Exchange and Active Directory details above, the broad defensive advice BleepingComputer attributes to the authorities is to review the indicators, patch vulnerable systems, disable unnecessary exposed services and enforce multifactor authentication. A reasonable plan, based on general industry practice and not any one source:
- Pull the IOCs (IPs, domains, hashes) from the advisory itself and search DNS, proxy, firewall and email logs.
- Search for the seized domain names in historical mail and web traffic, including the lookalike Microsoft and LinkedIn names.
- Audit internet-facing services. Anything old and exposed, such as legacy file transfer, DNS or VPN appliances, should be patched or taken offline.
- Check Exchange and other authentication logs for password-spray patterns, meaning many accounts with few attempts each. Enforce MFA.
- Look for unauthorized remote-administration tools such as SoftEther on endpoints and servers.
- Treat a scan hit or a domain match alone as a lead, not proof of compromise. Escalate to incident response when you see real evidence of access or outbound data transfers.
Context and limits
The DOJ calls this its second public technical disruption of Integrity Tech's infrastructure. The first was in September 2024, against a Mirai botnet of more than 200,000 consumer devices. BleepingComputer adds that the UK sanctioned the company in 2025 and the EU did so in 2026.
Seizing domains hurts, but it does not erase the tools. The operators can register new domains, and copies of the software and compromised devices may still exist. The seizure's value is in forcing the operators to rebuild and in handing defenders concrete indicators while the infrastructure is exposed. The DOJ's quoted view, from FBI Cyber Division's Brett Leatherman, is that the PRC relies on contractor and enabling companies to expand its operations. Exposing those enablers, he argues, makes it harder to target American networks.
There is a fair counterpoint. Attribution rests on government filings and an affidavit, and the company has not had its day in court. Taking down a few domains also does little for the thousands of unpatched systems the scanner could still find. For Windows admins, the lasting lesson is old-fashioned: keep exposed systems patched, tighten authentication, and watch for unexpected remote-access software.