FBI Seizes Chinese Hacking Infrastructure as Seven Nations Warn of Ongoing PRC Espionage Campaign
The FBI has seized seven web domains tied to hacking tools allegedly built and operated by Chinese security firm Integrity Technology Group. The tools were used by Beijing-backed operatives to probe critical infrastructure for weaknesses, including the network of a South Carolina power company.
Seven governments, the US, UK, Australia, Canada, Japan, New Zealand, and Spain, then piled on with a joint advisory naming Integrity Tech as the enabler behind a broader campaign of intrusion, data theft, and network compromise targeting organisations worldwide. The advisory details a fairly standard but effective playbook: vulnerability scanning, cross-site scripting, password spraying against Microsoft Exchange servers, VPN persistence, and credential and email exfiltration via custom scripts.
CISA used the occasion to add five CVEs to its Known Exploited Vulnerabilities Catalog. Some of these are ancient. CVE-2015-3306 and CVE-2015-5477 are a decade old. The fact that they're still worth cataloguing tells you something about the state of patching across critical infrastructure.
The seizures are part of a longer effort to disrupt Flax Typhoon, a Beijing-linked hacking crew the feds allege has been running a Mirai-based botnet since at least 2021. The botnet infected internet-connected devices, masked operators' real IP addresses, scanned for vulnerable systems, and served as launchpad for further attacks.
Integrity Tech allegedly developed the botnet itself, along with a vulnerability scanner called Microscan and a post-compromise tool called FishHub. Court documents unsealed Thursday allege the firm holds contracts with the PRC government, something Western agencies have been saying for a while. FishHub pulled additional malware onto victims' networks, created file listings, compressed documents of interest, and quietly shipped them off to attacker-controlled servers. FBI Special Agent Adam James, presumably with a straight face, noted in his affidavit that he believes the tool was named FishHub because it facilitated phishing. Thanks for that.
Microscan was accessed through one of the seized domains, c0cc[.]cc. Five others, including lookalike domains mimicking Outlook, YouTube, and LinkedIn, delivered FishHub malware as recently as March this year and compromised around 20 Taiwanese universities. Earlier confirmed victims include two other Taiwanese universities breached in 2022 and 2023, plus the South Carolina power company, a multinational NGO, airports in Japan and Poland, and at least two Taiwanese companies in the natural gas and power sectors.
The FBI claimed in September 2024 that Integrity Tech and Flax Typhoon dismantled their 260,000-device botnet after sustained pressure from US and allied agencies. That disruption was apparently more of a tactical retreat than a retirement. Private sector researchers and Western governments have continued to flag Chinese state-linked groups compromising routers and IoT devices and burrowing into critical networks throughout 2025.
OT security firm Dragos noted in February that China's infrastructure targeting hasn't slowed down, specifically flagging a group whose activity overlaps with Flax Typhoon. That group is focused on long-term access to operational technology engineering workstations and targets manufacturing, defence, automotive, power, oil and gas, and government organisations across the US, Europe, and Asia-Pacific.
A ten-country advisory issued in April described Chinese Typhoon groups as using botnets strategically and at scale. Integrity Tech was named there too, linked to the so-called Raptor Train network. The firm appears to be doing a brisk trade in state-sponsored intrusion infrastructure, regardless of how many domains get seized.