On 8 October 2026 the US Justice Department and FBI seized domains supporting two hacking tools, Microscan and FishHub. The same day, agencies from seven countries published a joint advisory, AA26-281A, describing how Chinese government-linked actors combine automated scanning with hands-on intrusion. The case is aimed at a company, not only a hacking group. That matters more than the seizures themselves.
What was actually seized
The Justice Department's announcement names six domains. One, c0cc.cc, was used to reach Microscan. Five others helped deliver FishHub: 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com and linkedinns.net (DOJ). Some press coverage counts seven domains, including 98aiblog.com (The Hacker News). We rely on the DOJ's list and note the discrepancy.
According to the DOJ, Microscan scanned victim networks for vulnerabilities, partly through a botnet of IoT devices infected with a Mirai variant. FishHub was a spear-phishing platform that, after a compromise, pulled down further malware for remote access or file theft. CISA's advisory describes Microscan as a Python-based web application, in use since 2017, with more than 1,300 penetration-testing scripts. The actors aimed it at software such as OpenSSL, Oracle WebLogic, WordPress, Jenkins and Apache Struts (CISA).
The DOJ lists Microscan victims including a South Carolina power company, a multinational NGO, Japanese and Polish airports, Taiwanese natural gas and power companies, and two Taiwanese universities. It says FishHub hit approximately 20 Taiwanese universities.
The contractor model is the story
FBI Assistant Director Brett Leatherman put the point plainly: "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity" (DOJ). The Record reports that Integrity Tech was hired by China's Ministry of State Security, and that the advisory covers the tools and others used over six years (The Record). The Hacker News notes the group is also tracked as Flax Typhoon, Ethereal Panda and RedJuliett, and that it was earlier tied to the Raptor Train botnet, which a US court-authorized operation took down in September 2024.
This is the second action against the same company in about two years. It suggests that disrupting infrastructure does not end the activity. Domains are cheap, and tooling that has run since 2017 can be rebuilt on new infrastructure.
The case for aggressive action
The strongest argument for this kind of enforcement is straightforward. State-backed scanning of airports and power companies is not ordinary espionage against government secrets. It maps the systems that societies depend on, and an actor with that map can do harm quickly in a crisis. CISA's Chris Butera said Chinese hackers "continue to position themselves within critical infrastructure networks" (The Record). Seizures also impose real costs: they cut off live infrastructure, expose tradecraft and force the operator to rebuild. Naming a for-profit enabler publicly is a legitimate deterrence tool.
Where the limits are
The case for a pro-innovation, proportionate response rests on what the advisory itself recommends. The mitigations are mostly basic: disable unused services, require multifactor authentication on webmail and VPNs, replace default passwords, patch promptly, use protective DNS, segment networks and keep offline backups (CISA). Microscan worked because known weaknesses in widely deployed software stayed unpatched. Seizing a domain does not fix a WordPress plugin or a Jenkins server that was left exposed.
That has policy consequences. First, defensive investment and rapid vulnerability disclosure and patching do more to reduce harm than takedowns do. Regulators should reward them, not just punish breaches after the fact. Second, the contractor model creates a risk of overreach on our side. If governments respond to Integrity Tech by restricting legitimate security research, penetration-testing tools or cross-border security work, they will hurt defenders more than attackers. Microscan was effective in part because it looked like a standard penetration-testing toolkit. Rules that treat dual-use scanning software as contraband would sweep in the researchers who find these flaws first.
Third, the advisory carries a caveat that readers should keep in mind. Authorities describe their findings as allegations from affidavits and attribution analysis. Not all of the activity can necessarily be tied to Integrity Tech. Court-authorized seizures are a narrow instrument, and the public record so far does not test the underlying attribution in an adversarial proceeding.
What the coalition signals
The participation of the UK's NCSC, Australia's ACSC, the Canadian Centre for Cyber Security, Japan's National Police Agency, New Zealand's NCSC-NZ and Spain's CNI matters. Victims in Japan, Poland and Taiwan are not US interests, and a shared attribution makes it harder for Beijing to dismiss the findings as a bilateral dispute. It also gives smaller governments a template for naming commercial enablers instead of only anonymous threat clusters.
The open question is whether the pressure reaches the business model. Sanctions, indictments and domain seizures have now been applied to Integrity Tech repeatedly without visibly stopping it. A durable response would pair these actions with funding for patching and monitoring at smaller utilities and airports, and with clear safe harbours for security researchers. The seizures are a useful signal and a short-term disruption. The long-term fix is hardening the networks the scanners keep finding open.