US Disrupts Chinese Hacking Tools MicroScan and FishHub
The US government announced the disruption of two hacking tools, MicroScan and FishHub, built by Integrity Technology Group and utilized by Chinese state-sponsored threat groups.
Radwan AbdulhadiEditor and technology writer
Disruption of MicroScan and FishHub
The United States announced the disruption of two key hacking tools utilized by Chinese state-sponsored threat actors in cyberattacks targeting both US and international critical infrastructure. The tools, named MicroScan and FishHub, were developed by Integrity Technology Group, also known as Integrity Tech. According to US authorities, MicroScan functioned as a vulnerability scanning application, whereas FishHub facilitated unauthorized network intrusions via spear phishing.
To support MicroScan's reconnaissance capabilities against victim networks, Integrity Tech allegedly employed a Mirai malware variant to construct an Internet of Things (IoT) botnet. The impacted targets included a US power company, non-governmental organizations, Japanese and Polish airports, as well as critical infrastructure entities and universities in Taiwan. Meanwhile, FishHub allowed clients of Integrity Tech to remotely access compromised networks, search for targeted files, and exfiltrate data, with at least 20 universities in Taiwan impacted by its use.
Domain Seizures and Sanctions History
In response to these malicious campaigns, the United States seized several domains that the threat actors relied on to access MicroScan and FishHub. The seized domains include c0cc[.]cc, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.
This disruption follows a history of international regulatory and enforcement actions against Integrity Tech. In 2024, the US disrupted the company's Raptor Train botnet and subsequently sanctioned it in 2025 for supplying cybersecurity products to Chinese state-sponsored Advanced Persistent Threats, including Flax Typhoon. Furthermore, the European Union imposed its own sanctions on the company in March 2026.
Capabilities and Long-Term Operations
A comprehensive new joint advisory released by government agencies across the US, UK, Australia, Canada, Japan, New Zealand, and Spain indicates that MicroScan has been actively deployed since at least 2017. The tool has targeted a wide variety of services, including Apache Struts, Juniper ScreenOS, Jenkins, OpenSSL, Oracle, Rejetto HFS, WebLogic Server, and WordPress.
Described as a Python-based web application, the advisory notes that MicroScan contains over 1,300 penetration testing scripts written to scan websites for specific vulnerabilities. While the platform was primarily associated with Flax Typhoon—also tracked under aliases such as Ethereal Panda, Red Juliett, Storm-0919, and UNC5007—investigators believe Integrity Tech collaborated with multiple other Chinese APT groups as well.
Reconnaissance and Data Exfiltration Tactics
Beyond MicroScan, Flax Typhoon actors leveraged an array of supplementary tools for reconnaissance, including BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan. For initial access, the hackers depended on command-line exploit utilities and the EBurst Microsoft Exchange password spraying tool.
To maintain persistence within victim environments, the threat actors deployed VPN applications like SoftEther. They also downloaded databases or manually extracted information directly from victims' email addresses. Their exfiltration toolkit featured the PHP script Curlc4.txt, the command-line utility office-cli, and DC.ex for extracting sensitive Active Directory details.
Targeting and Geographic Scope
According to the joint advisory, the threat actors routinely harvested account credentials and exfiltrated email data from both on-premises systems and cloud-based services. The scope of email data theft affected government organizations, law enforcement agencies, healthcare systems, and religious institutions situated in Southeast Asia.
In several observed instances, the operators took steps to conceal their activities by restricting access to the stolen exfiltrated data exclusively to Internet Protocol addresses originating from Xiamen, China. The ongoing multi-agency investigations highlight the persistent threat posed by state-sponsored cyber operations against global infrastructure.
Sources
- SecurityWeekUS Disrupts Chinese State-Sponsored Hacking Tools
Continue chronologically
Related stories
Cloudflare Q3 2026 Report Highlights Short DDoS Swarms
Cloudflare's Q3 2026 DDoS report reveals a shift toward short, high-frequency attacks alongside the collapse of CLDAP vectors and IoT botnet changes.
Anthropic Warns Small AI Models May Self-Replicate via IoT
Anthropic researchers warn that small AI models could soon self-replicate across Internet of Things devices as a new generation of computer worms.
Mirai Botnet Operators Join PHP2Shell Attacks
Mirai botnet operators and attackers target PHP2Shell flaws as ASLR bypass exploits emerge, though no successful compromises are yet confirmed.
VicOne Uncovers 28 Zero-Day Flaws in Physical AI Tools
VicOne researchers used AI-assisted techniques to identify 28 zero-day vulnerabilities across software supporting the Physical AI ecosystem in under two days.
