The FBI, CISA, the NSA and their international partners have warned regarding cyber operations carried out by Integrity Technology Group, a company based in China that is said to have links with the Chinese government. The agencies state that this activity involved the use of automated scanning, botnets, VPN infrastructure and direct intrusion techniques in order to target organisations all over the world, including critical infrastructure.
Meanwhile, the U.S. Department of Justice and the FBI declared that court-authorised seizures had been carried out of seven internet domains associated with two tools, Microscan and FishHub. The investigators state that these tools were used to scan networks and, in certain cases, to assist in intrusions, spear-phishing, remote access, and data theft.
The importance of the warning does not lie in the fact that each scan indicates an imminent attack, but rather in the fact that it outlines a pattern of persistent cyber activity—namely, to identify exposed systems on a large scale, gain access whenever possible, and then stay within certain networks. For operators of critical infrastructure, the practical priority should be to detect any exposure, look for signs of compromise, and remedy the vulnerabilities in internet-facing systems and edge devices.
What agencies disclosed
The cybersecurity advisory issued jointly by the U.S. agencies and partners from the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain was published on 8 October 2026 and details activity linked to Integrity Technology Group and the threat actors it is said to have enabled.
The advisory states that Integrity Tech acquired or developed cyber tools, offered hosting infrastructure, and gave support to network compromises. The agencies claim that this activity was directed at organisations in the United States and in other countries, covering sectors such as government services, critical manufacturing, healthcare and public health, and information technology. Among the other organisations said to have been targeted were those in law enforcement, education and the religious sector, as well as companies in Southeast Asia, Africa and North America.
The FBI and Justice Department described two tools in particular:
- Microscan was employed as a tool for carrying out vulnerability reconnaissance; according to court documents it scanned networks via a botnet consisting of internet-connected devices that had been infected with a variant of Mirai malware.
- FishHub was linked to spear-phishing and activity carried out after a compromise. The Justice Department stated that it could be used to deliver further malware, allow unauthorised remote access, or search for files and send them to servers owned by Integrity Tech.
The FBI stated that the domains used to access or support these tools had been seized on the basis of a court order. The move was designed to disrupt the infrastructure, and the accompanying advisory provides defenders with technical information so that they can identify and respond to related activity.
Why the campaign matters
The kind of activity that the various agencies talk about is not confined to a single operation or a single target; it illustrates the way in which reconnaissance, compromised devices, phishing, and direct intrusion can be combined.
A botnet can provide scale; a scanning tool can be used to identify systems that are exposed to the internet; phishing can offer an attacker a means of getting into a particular organisation; and after that legitimate system utilities can assist the intruder in moving around the network while drawing less attention than would be the case with unknown malware.
The fact that this combination is important for critical infrastructure is because a great many essential services depend on technology which is either hard to replace or difficult to take out of operation. Services such as power supply, water supply, healthcare, transport, manufacturing and government operations usually make use of a mix of modern IT, older systems, remote access and operational technology (OT).
The advisory from CISA cautions that attackers might aim for long-term, covert access to networks, including those in the OT environment, so as to be able to disrupt critical functions at a later stage. This represents the agency’s view of the threat, not proof that each affected organisation was preparing for an immediate disruption. Yet, even if the attackers do not cause an outage or make their presence known, persistent access can still pose a strategic risk.
Understanding the tools
Microscan: scanning at scale
Security scanning is not by nature malicious; organisations employ vulnerability scanners in order to identify exposed services and outdated software so that they can remedy the weaknesses. What is important is authorisation, intent, and the actions taken after a weakness has been discovered.
According to the Justice Department, Microscan carried out reconnaissance by using a botnet consisting of internet-of-things devices that had been infected. The botnet contained devices infected with a variant of Mirai; the department’s court documents mention scanning being directed at a power company in South Carolina, a multinational non-governmental organisation, airports in Japan and Poland, the energy infrastructure in Taiwan, and the universities in Taiwan.
Large-scale scanning can assist operators in creating a map of the systems that are exposed. A scan by itself doesn’t prove that a network has been compromised; however, if the scanning is followed by exploitation, the abuse of credentials, or attempts to maintain access, then it becomes part of a broader intrusion chain.
FishHub: phishing and follow-on access
FishHub was referred to as a spear-phishing tool. The Justice Department stated that it could be used to exploit networks, deliver further malware following an initial breach, allow for remote access, and search for files to be sent to servers under the control of the attacker. The department said that confirmed instances of FishHub use had involved about 20 Taiwanese universities.
It’s a well-known pattern to start by sending a custom message in order to gain an initial position, and then to use various tools that enable further access or the gathering of data. The danger does not lie in the phishing email alone; rather, it is in the sequence that leads from the user’s interaction to a lasting foothold, to movement across different systems, and to possible data loss.
What defenders should look for
The advisory jointly issued contains technical indicators as well as defensive advice. Organisations should use the main advisory to obtain the complete list of indicators, the vulnerabilities that are affected, and the detection recommendations.
At a practical level, defenders should focus on several areas:
- For infrastructure that is accessible via the Internet, identify any exposed services, such as VPN appliances, firewalls, routers, web servers, and other edge devices.
- Available exploited vulnerabilities: review the vulnerability list in the advisory and make sure that the products in question have the necessary patches or mitigations applied.
- Check the VPN, remote-management, and administrative access for any unfamiliar accounts, locations, devices, or times.
- There has been unusual authentication activity: you should look into password-spraying patterns, repeated failure instances across different accounts, and any suspicious access to email or identity services.
- Look for abnormal network scanning, such as connections to a large number of internal or external hosts, particularly when systems which usually do not perform scanning are doing so.
- The use of legitimate administrative tools: Threat actors can use built-in utilities in order to avoid having to deploy obvious malware. This approach known as ‘living off the land’ needs behavioural monitoring, not just detection based on signatures.
- Look at file access that is unusual, check when archives are created, monitor outbound transfers, and examine connections to hosting infrastructure you are not familiar with.
- For OT and industrial networks, verify that remote access to operational environments is necessary, is restricted, is logged, and is separated from corporate IT.
The advisory specifically tells defenders to search for any possible compromises and to put into effect the recommended mitigations. Meanwhile, CISA also stresses the importance of securing edge infrastructure and applying patches to the vulnerabilities that are listed.
A practical response plan
1. Confirm your exposure
Begin by making a list of all systems that are accessible over the internet and note who owns them; you must also include systems that are managed by service providers, subsidiaries, and contractors since an organisation cannot patch or monitor a system of which it has no knowledge.
2. Prioritise exposed and vulnerable devices
Check your inventory against the list of vulnerabilities given in the advisory. Where possible, apply a patch. If you have to delay patching, then use the mitigations recommended by the vendor, restrict access, or temporarily turn off the exposed services when it is operationally safe.
3. Hunt before you assume
Look in the relevant logs using the advisory’s indicators and behavioural details. Check the endpoint, firewall, VPN, identity, DNS, proxy, and cloud records. Simply having a clean antivirus scan is not sufficient to rule out compromise.
4. Review privileged accounts
Make sure that administrator and service accounts are needed, secured using strong authentication, and kept under supervision. Get rid of obsolete accounts and check for any unexpected changes to permissions, authentication methods, and remote-access settings.
5. Separate IT from OT
Where possible, operational technology should be separated from regular business networks. Administrative access should be restricted, approved jump hosts should be required, and any connection between the enterprise’s IT environment and the operational environment should be monitored.
6. Prepare an incident decision path
When there is evidence that a compromise has taken place, it is important to know who is responsible for isolating the systems, contacting the regulators, bringing in incident responders, preserving the evidence, and coordinating with government authorities. In the case of critical services, the response plans have to consider both safety and continuity, not just technical containment.
The risk of over-attribution
The advisory connects the activity to Integrity Tech and mentions links with Chinese government-associated cyber actors, while also pointing out that some of the activity matches the names used in industry reports, such as Flax Typhoon, Ethereal Panda, and Red Juliett.
The labels must be dealt with carefully since the naming conventions used by threat actors differ between cybersecurity firms and government agencies. The fact that similar tactics are observed does not mean that all the incidents were carried out by the same group, and the use of a particular tool or hosting service by itself does not identify the individual operator.
For organisations, concern about attribution is generally less important than finding out whether their systems had been accessed, what data or functions were exposed, and how the incident could be contained. The technical details given in the advisory are useful since they aid that defensive work.
What the domain seizures achieve—and what they do not
Taking control of domains can lead to a disruption of access to various tools and infrastructure; it might interrupt operations, decrease the attackers’ ability to communicate with the systems that have been compromised, and make certain activities easier to investigate. The Justice Department states that the action authorised by the court was aimed at domains that were used in connection with Microscan and FishHub.
Yet the fact that disruption fails to get rid of infected devices, stop all vulnerabilities, or remove the other infrastructure means that attackers could try to rebuild, move to different domains, or make use of alternative tools. This is the reason why domain seizures should be combined with patching, network monitoring, incident response, and cooperation between the affected organisations.
The Justice Department stated that this constituted its second public technical interference with Integrity Tech’s operations, mentioning that an earlier action in September 2024 had disrupted a Mirai-based botnet made up of over 200,000 consumer devices.
The bigger lesson for critical infrastructure
Security in relation to critical infrastructure involves more than just protecting a main data centre; the exposed edge—this including remote-access systems, routers, VPN appliances, unmanaged devices, and connections with suppliers—can decide whether an attack succeeds in gaining a foothold.
The activity described in the advisory reinforces several principles:
- Suppose that devices which are exposed will be found, since automated scanning enables one to identify vulnerable systems rapidly.
- Treat small devices as if they were security-critical because if a router or a camera is compromised it can be used as part of a botnet or as a stepping stone.
- You shouldn’t base your actions solely on malware detection since attackers can use legitimate accounts and the built-in tools.
- Make access obvious. Logging and monitoring should include coverage of remote connections, privileged actions, and data movement.
- Make arrangements to stay persistent since a subtle intrusion is more hazardous than a loud one if it goes unnoticed.
- Co-ordinate between the different sectors. Threat information is more useful when the government, the operators of the infrastructure and the security vendors promptly share it.
The measures described do not apply only to the organisations mentioned in the advisory; any entity which has exposed systems, remote access, or sensitive data can take steps to examine its defences.
What should leaders ask now?
There is no need for executives and boards to interpret each and every indicator of compromise, but they should ask their security teams and service providers:
- Are we running any products that are listed in the advisory and which are accessible via the internet?
- Have we looked into them for the vulnerabilities and behaviours mentioned?
- Can we detect unusual scanning, remote access, and the use of administrative tools?
- Is the separation between our OT and IT environments adequate?
- What access do suppliers have to our networks, and how is that access monitored?
- Yes, do we have the means of reporting a possible compromise to the appropriate authorities?
Giving clear answers to those questions is more helpful than just stating that an organisation is “not a target”. The advisory mentions general targeting and infrastructure reconnaissance; organisations should act on the basis of their exposure and the evidence available, not on assumptions regarding their perceived importance.
The takeaway
The warning issued by the CISA, the FBI, and the NSA refers to a cyber ecosystem that revolves around tools, infrastructure, and access, rather than involving a single malware family or isolated breaches. The U.S. authorities state that Integrity Technology Group had allowed threat actors to use its scanning capabilities, botnets, hosting services, and intrusion tools, and the Justice Department’s action involving the seizure of domains was directed at the infrastructure linked to Microscan and FishHub.
For those defending the system, the first priority is to carry out practical actions such as reviewing the advisory, making a list of any systems that are exposed, applying patches or addressing the known vulnerabilities, looking for signs that the system has been compromised, and then checking the security of the remote access and edge devices.
The main point is that attacks on critical infrastructure can take place well before any obvious disruption is seen, and one way of ensuring that essential services remain reliable is to locate and get rid of quiet access early on.
About the Author
