US Seizes Six Domains Operating Integrity Tech MicroScan and FishHub Tools Since 2017
US domain seizures against Integrity Tech expose a long-running Chinese vendor pipeline supplying MicroScan and FishHub to multiple APTs. International advisory reveals coordination depth but highlights gaps between technical attribution and official state-actor claims. Pattern indicates continued dual-use contractor exploitation ahead of further infrastructure takedowns.
The disruption targeted a Python-based MicroScan suite with over 1,300 exploit scripts against Apache Struts, Jenkins and WebLogic, deployed via a Mirai-variant IoT botnet for reconnaissance. FishHub provided remote file search and exfiltration on at least 20 Taiwanese campuses. Technical indicators include hardcoded Xiamen IP restrictions on stolen email databases and use of SoftEther VPN plus DC.ex for Active Directory dumps.
Procurement records and prior sanctions show Integrity Tech supplied Flax Typhoon and at least two additional Chinese APTs after the 2024 Raptor Train botnet takedown. The March 2026 EU sanctions and 2025 US designations align with contract awards for defensive tools that were repurposed for offensive scanning, revealing a dual-use pattern missed in initial reporting.
Seven-nation advisory coordination marks the widest public Five Eyes-plus effort against a single Chinese vendor to date. Evidence trails remain limited to domain logs and victim telemetry; no independent packet captures confirm direct state tasking beyond shared TTPs with Flax Typhoon.
Next phase likely involves sinkholing of remaining command infrastructure and renewed sanctions on downstream Chinese resellers within 120 days.
CISA: Two additional Integrity Tech-linked domains sinkholed by October 2026
Sources (2)
- [1]CISA Joint Advisory AA26-XXX(https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-xxx)
- [2]EU Sanctions Notice March 2026(https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R0XXX)