FBI Seizes Chinese Contractor's Hacking Tools Used Against US Agencies as CISA's Patch Deadline Passes

The FBI has seized seven internet domains used to run two hacking tools, MicroScan and FishHub, operated by Integrity Technology Group, a Beijing company with Chinese government contracts. US and allied agencies tie the company to the hacking group known as Flax Typhoon. A joint advisory from CISA, the FBI and the NSA, with Australia, Canada, Japan, New Zealand, Spain and Britain, lists victims including US government agencies, manufacturers, hospitals, IT firms, law enforcement, schools and religious groups.

MicroScan is a scanner with more than 1,300 penetration-testing scripts, used together with a botnet of hijacked devices. FishHub ran phishing and data theft. According to the FBI affidavit, scan targets included a South Carolina power company, airports in Japan and Poland, and Taiwanese gas and electricity firms. The FBI didn’t say whether those targets were breached. The FishHub server held data from more than 20 organisations.

The federal deadline

CISA added five actively exploited vulnerabilities used by the group to its Known Exploited Vulnerabilities catalogue. Under a binding operational directive, federal civilian agencies had until 11 October to patch the affected products or stop using them. Some of the flaws are old: one in the ProFTPD file server dates to 2015 and has the maximum severity score of 10.0.

Chris Butera, CISA’s acting executive assistant director for cybersecurity, said Chinese state-linked actors “continue to position themselves within critical infrastructure networks.” Brett Leatherman of the FBI’s Cyber Division said “disrupting these organizations makes it harder for China-linked hackers to target American networks.”

History

In September 2024 the Justice Department took down a botnet of about 200,000 devices run by the same company. Britain sanctioned it in 2025 and the EU in 2026.

Other federal breaches this week

• The hacking group ShinyHunters breached FBIjobs.gov, a recruitment site run by a vendor, exposing FBI employees’ names, home addresses and relatives’ details. The FBI blamed a missed security update and removed a contractor. The FBI says the group has hit more than 140 organisations.
• GAO will review three incidents on DHS’s Homeland Security Information Network, including a 2026 intrusion that analysts twice dismissed as a false positive before DHS declared a breach on 4 June.

Why it matters

Old, unpatched software keeps giving state hackers a way in. CISA’s deadlines only bind civilian agencies, not the power companies and hospitals the group targets. CISA itself has lost about a third of its staff since early 2025, and its incident reporting rule for critical infrastructure is still under White House review, as covered in our CIRCIA post.