(diesec.com) FBI Seizes Domains Linked to Chinese APT Tools MicroScan and FishHub Targeting Critical Infrastructure
In brief - This article describes the FBI's seizure of seven domains used by the Chinese company Integrity Technology Group to operate the MicroScan and FishHub hacking tools. The operation targeted critical infrastructure and educational institutions globally, utilizing a combination of vulnerability scanning and spear-phishing.
Technically - This article details the use of MicroScan for network mapping via a Mirai-variant botnet and FishHub for delivering spear-phishing payloads and exfiltrating data. The threat actor employed password spraying against Microsoft Exchange using the EBurst tool, utilized SoftEther VPN for persistence, and targeted eight specific legacy vulnerabilities, including CVE-2019-11510 (Pulse Secure) and CVE-2014-6278 (Shellshock). The infrastructure included lookalike domains for Microsoft, LinkedIn, and YouTube to facilitate social engineering and malware delivery.
Source: https://diesec.com/2026/10/flax-typhoon-integrity-tech-domain-seizure/