FBI Seizes Seven Domains Behind Chinese Hacking Tools Targeting Taiwan Universities and Energy Networks

Seven domains seized, about 20 Taiwanese universities confirmed as victims

The FBI and US Justice Department announced on October 8, 2026, that they had seized seven internet domains supporting hacking tools operated by Integrity Technology Group, a Chinese cybersecurity company with government contracts. One tool, Microscan, searched for weaknesses in networks belonging to Taiwanese energy companies, airports in Japan and Poland, and a South Carolina power company. Another, FishHub, was linked to confirmed intrusions at approximately 20 Taiwanese universities.

The action targeted infrastructure behind the hacking campaign known as Flax Typhoon. According to the Justice Department's October 8 announcement, court documents unsealed in the Western District of Pennsylvania allege that Integrity Technology Group developed and operated tools that its clients used to identify vulnerable networks, gain unauthorized access and steal files.

The FBI said the operation rendered the tools inoperable. That does not mean every compromised network is now secure: seizing domains interrupts the attackers' infrastructure but does not automatically remove malware, stolen credentials or remote access software already inside victims' systems.

The evidence also distinguishes between networks scanned and networks successfully breached. Authorities identified Taiwanese natural gas and power companies, the South Carolina utility, Japanese and Polish airports, and a multinational nongovernmental organization as Microscan targets. They did not disclose whether each of those organizations was successfully compromised.

For universities, the evidence is more specific. An FBI affidavit describes successful breaches following Microscan scans at two Taiwanese universities in August 2022 and March 2023. Separately, the Justice Department identified approximately 20 Taiwanese universities as confirmed victims of FishHub activity. The institutions have not been publicly named, and the two groups cannot simply be added together because their overlap has not been disclosed.

What the court action actually shut down

A federal magistrate judge authorized the seizures on October 6, two days before the public announcement. The warrant directed domain registries to lock the domains, redirect them to servers controlled by the FBI and display seizure notices. This denied the operators use of addresses supporting scanning, malware delivery and continuing access to compromised networks.

The Western District of Pennsylvania's seizure announcement specifies seven domains. One, c0cc[.]cc, provided access to Microscan. Five helped deliver FishHub malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net. The remaining domain, 98aiblog[.]com, was associated with SoftEther software used to maintain remote access.

The supporting affidavit alleges violations of the Computer Fraud and Abuse Act, the US law covering unauthorized access to computers. It also says purchases or renewals of the domains used money originating outside the United States. No arrests or criminal charges were announced alongside the seizures. The allegations in the court documents are not findings of guilt.

Microscan turned infected devices into a reconnaissance network

Microscan was a web application written in Python, a widely used programming language, containing more than 1,300 scripts for testing security weaknesses. Such scripts can have legitimate uses in authorized security assessments. Here, investigators allege they were used to examine other organizations' systems for weaknesses that Integrity Tech's clients could exploit.

The software searched websites and services running products including OpenSSL, Oracle WebLogic Server, WordPress, Jenkins and Apache Struts. Investigators said Microscan remained accessible through c0cc[.]cc as recently as September 9, 2026, and may have been used as early as 2017.

Some scans passed through consumer devices infected with a variant of Mirai malware. Together, those devices formed a botnet, a collection of compromised machines controlled by an operator. Routing traffic through other people's devices helped conceal the origin of the scanning and supplied infrastructure spread across many locations.

The accompanying cybersecurity advisory identifies eight commonly targeted vulnerabilities, with identifiers dating from 2014 to 2023. They include weaknesses in GNU Bash, Apache Struts, Pulse Secure VPN and GitLab. Some allow an attacker to read files without permission or run commands on a vulnerable system. The range shows that the campaign was not limited to newly discovered flaws; older, unpatched software also presented opportunities.

FishHub supported access and theft after the first breach

FishHub served a different purpose from Microscan. Authorities allege that it supported spear phishing, deceptive messages aimed at particular recipients, and downloaded additional malware after an initial network compromise. That malware could give Integrity Tech's clients remote access or search for selected files and transmit them to servers controlled by the company.

The alleged file theft process included listing documents, searching for specified material, compressing files and sending them out of the victim's network. This made FishHub more than a delivery mechanism: it supported the collection and removal of information after attackers had gained entry.

The FBI affidavit describes data and files belonging to more than 20 organizations on a server associated with FishHub, including six Taiwanese universities. That finding is narrower than the Justice Department's count of approximately 20 Taiwanese university victims. The six universities refer to evidence found on one server, while the larger number describes confirmed FishHub activity. Neither count establishes the total number of organizations affected worldwide.

University networks can contain research, administrative records and correspondence, but officials have not disclosed which categories of information were taken from the Taiwanese institutions. The public account also does not quantify how much data was stolen or identify the individuals whose information may have been affected.

Legitimate software helped attackers stay inside networks

The joint advisory from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency and international partners describes several ways the actors obtained credentials and maintained access. These included cross site scripting, which can misuse a vulnerable website to capture information from users, and password spraying against Microsoft Exchange systems. Password spraying tries a small set of common passwords against many accounts rather than repeatedly guessing one account's password.

Investigators also described SoftEther VPN software installed on compromised systems to maintain access, sometimes disguised as legitimate Windows files. A VPN creates a network connection that can support ordinary remote work. When installed without authorization, it can give an attacker a continuing route into an organization's systems.

Other tools were used to collect Active Directory credentials and extract email from Exchange and Microsoft 365 accounts. Active Directory manages user identities and access in many organizations, so stolen credentials can open access beyond the first compromised computer. Investigators also found a custom web application that allowed third parties to browse stolen emails without directly accessing the affected accounts.

Chen Yun-nung, a computer science professor at National Taiwan University, explained why malicious activity using existing software can be difficult to spot:

The malicious program hides in existing management software and uses legitimate software for malicious acts. For example, it can download and export your data, making it harder to detect because you will not see any additional programs running, just the original programs already there.

That distinction matters for cleanup. Looking only for unfamiliar programs may miss unauthorized use of software that administrators normally trust.

A company behind the campaign, not just individual hackers

US authorities describe Integrity Technology Group as an enterprise supporting Chinese government linked cyber operations. The company is based in Beijing and has contracts with the Chinese government. The FBI regards it as the organization behind activity known in the private sector as Flax Typhoon.

Brett Leatherman, assistant director of the FBI's Cyber Division, described the company's role in the Justice Department announcement:

The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.

The advisory describes activity overlapping with operations tracked as Flax Typhoon, Ethereal Panda and Red Juliett. It cautions that not all the overlapping activity is necessarily attributable to Integrity Tech. Those campaign names therefore should not be treated as proof that every associated intrusion was conducted by the same company.

FBI Cyber Division Deputy Assistant Director Jason Bilnoski described the enforcement strategy in direct terms:

We aim to remove the capability from the threat actors. We target their infrastructure, their money, and their tools.

Bilnoski called the hacking operation "indiscriminate and reckless." The agencies' wider advisory describes targets across government, manufacturing, healthcare, information technology, law enforcement, education and religious organizations, with activity spanning Southeast Asia, Africa and North America.

How the latest seizure follows earlier action

The October operation is the Justice Department's second public technical disruption of Integrity Tech's hacking infrastructure. The first, in September 2024, targeted a Mirai botnet containing more than 200,000 consumer devices worldwide, including cameras, video recorders, and home and office routers.

Investigative records provide a more detailed snapshot from June 5, 2024. A database contained more than 1.2 million infected device records, including over 385,000 unique US victim devices. More than 260,000 devices were actively infected on that date, including approximately 126,000 in the United States. Database records and active infections measure different things, so the 1.2 million figure should not be read as the number simultaneously under the operators' control.

The main dates show a campaign and enforcement response stretching across several years:

• August 2022 and March 2023: Microscan scans preceded successful breaches at two Taiwanese universities, according to the FBI affidavit.
• September 2024: US authorities disrupted Integrity Tech's Mirai botnet of more than 200,000 consumer devices.
• January 2025: The US Treasury Department sanctioned Integrity Technology Group over its involvement in cyber intrusions targeting US infrastructure.
• 2025 and 2026: The United Kingdom and European Union, respectively, also sanctioned the company over cyberattack activity.
• September 9, 2026: Investigators confirmed Microscan remained accessible through c0cc[.]cc.
• October 6, 2026: A federal magistrate judge authorized the domain seizures.
• October 8, 2026: The Justice Department and FBI announced the operation and a joint cybersecurity advisory.

The latest action targeted scanning, malware delivery and remote access infrastructure rather than announcing another removal of a large consumer device botnet. The interventions attacked different parts of the alleged operation.

Critical infrastructure warnings do not establish an outage

The inclusion of power companies, natural gas businesses and airports makes the campaign a concern beyond data theft. Chris Butera, CISA's acting executive assistant director for cybersecurity, warned about the possible purpose of access to critical systems:

Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing.

Operational technology refers to systems that monitor or control physical processes, such as industrial equipment. Access to those systems can carry different risks from access to ordinary office email.

Butera's warning describes a threat, not a finding that this campaign caused an electricity outage, airport disruption or interruption to Taiwanese gas supplies. Authorities have not disclosed successful breaches at every named infrastructure target, and the announcement does not establish that those organizations' operational systems were compromised.

The public evidence is strongest on scanning, unauthorized access and information theft. Keeping those findings separate from the possibility of future disruption avoids overstating what investigators have demonstrated.

What defenders must check after the seizure

The joint advisory includes domains, IP addresses, malware hashes and descriptions of tools to help organizations investigate possible intrusions. Agencies from the United States, United Kingdom, Australia, Canada, Japan, New Zealand and Spain participated in the advisory effort.

Recommended measures include patching systems exposed to the internet, requiring multifactor authentication for webmail and VPN access, disabling unused services and reviewing web application logs for scanning or exploitation attempts. Administrators are also urged to monitor unauthorized remote access software and unexpected Active Directory replication, which can indicate attempts to copy identity data.

Some indicators date to 2016. They should be investigated in context rather than automatically treated as evidence of a current compromise. Historical associations can help reconstruct an intrusion, but an old indicator alone does not establish that a system is presently controlled by attackers.

Wang Po-chi, an associate professor of criminal justice at Ming Chuan University, cautioned that sanctions and technical disruption might not prevent the operators from returning:

Even if this company is sanctioned, it might set up another operation to start the same activities. It may feel it has little to fear because the company might be based in one place, but the servers launching the attacks might be located elsewhere.

FBI San Diego Supervisory Special Agent Brett Lally said the bureau would monitor whether the company rebuilt its infrastructure. The San Diego and Baltimore field offices are investigating with the FBI Cyber Division, and Japan's National Police Agency assisted. Prosecutors Brendan McKenna and Jacques Singer-Emery are handling the case. No next hearing date or deadline was announced.

Key Points

• The FBI seized seven domains supporting Microscan, FishHub and unauthorized remote access associated with Integrity Technology Group.
• Approximately 20 Taiwanese universities were confirmed victims of FishHub activity.
• Microscan targeted Taiwanese energy companies, a South Carolina power company, airports in Japan and Poland, universities and a multinational nongovernmental organization.
• Authorities did not disclose whether every named infrastructure target was successfully breached.
• The seizures follow a September 2024 botnet disruption and sanctions imposed by the United States, United Kingdom and European Union.
• Domain seizures interrupt attacker infrastructure but do not remove malware or stolen credentials already inside victim networks.
• No arrests, criminal charges or next hearing date were announced with the operation.