The FBI and Justice Department announced Thursday that they have seized the digital infrastructure behind two hacking tools used by Chinese state-backed hackers — a vulnerability scanner and a phishing platform that targeted power companies, airports, universities and government networks in the United States and abroad.
Here is how the operation unfolded, and why officials say it matters.
The seizure: October 8
Federal prosecutors in the Western District of Pennsylvania unsealed court documents authorizing the seizure of internet domains supporting two tools: “Microscan,” which scanned networks for security weaknesses, and “FishHub,” which ran phishing operations that let hackers steal files and remotely control victim computers.
The seizures have rendered both tools inoperable, officials said. The Justice Department described it as a court-authorized operation to “deny malicious cyber actors access” to the tools.
The operator: Integrity Technology Group
Both tools were operated by Integrity Technology Group, a Chinese information-security company that the FBI says holds contracts with the Chinese government. The bureau identifies the company as the true identity of “Flax Typhoon,” the name private-sector security researchers gave to a broad, long-running Chinese hacking campaign.
According to court documents, Integrity Tech ran Microscan through a botnet — a network of hacked internet-connected devices — that swept other networks for weaknesses its clients could exploit.
This is the second time in as many years that US law enforcement has disrupted Integrity Tech’s operations, said US Attorney Troy Rivetti.
The targets: power grids, airports, universities
The scanning was wide and, in the FBI’s telling, indiscriminate. Targets included an unnamed power company in South Carolina, airports in Japan and Poland, Taiwanese natural gas and power companies, two Taiwanese universities, and a multinational nongovernmental organization.
Being scanned is not the same as being breached — the reconnaissance identifies weaknesses that intruders can use to gain access later. But the scale alarmed officials: government, manufacturing, healthcare, law enforcement and education organizations were all in the crosshairs.
“The [People’s Republic of China] relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” said FBI Cyber Division Assistant Director Brett Leatherman. “By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”
The warning: seven governments, one advisory
The seizure landed alongside a joint advisory from the US Cybersecurity and Infrastructure Security Agency, the FBI, the National Security Agency and international partners — the UK, Australia, Canada, Japan, New Zealand and Spain — warning that Integrity Tech supplies tools and technical support to China-linked hackers worldwide.
CISA also added a batch of exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to patch them.
The rhetoric: unusually blunt
Justice Department officials did not mince words. “The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace,” said Assistant Attorney General for National Security John Eisenberg, promising to “disrupt the Flax Typhoon threats” and “dismantle the infrastructure sustaining them.”
FBI Cyber Division Deputy Assistant Director Jason Bilnoski called the operation “indiscriminate and reckless,” adding: “We aim to remove the capability from the threat actors. We target their infrastructure, their money, and their tools.”
What happens next
Seizures like this rarely end a campaign; they raise its cost. Flax Typhoon’s operators will rebuild, likely with new tools and new infrastructure. The real question is whether the exposure — naming the contractor, detailing its methods, rallying seven governments behind one advisory — makes Beijing’s hacking-as-a-service model harder to run.
China’s embassy did not immediately respond to requests for comment. Beijing has consistently denied sponsoring hacking operations against the United States.
For the power company in South Carolina and the airports in Japan and Poland, the reassurance is thinner: the tools that mapped their networks are offline, but the people who built them are not.
