What happened
The Justice Department and the FBI announced court-authorized seizures to cut off access to two hacking tools, Microscan and FishHub, used to scan and in some cases break into U.S. and foreign critical infrastructure. Court documents unsealed in the Western District of Pennsylvania name the operator as Integrity Technology Group, a Beijing company that holds contracts with the Chinese government. The group is tracked as Flax Typhoon, also called Ethereal Panda and RedJuliett.
Seven domains were seized: c0cc[.]cc, 98aiblog[.]com, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net. Microscan, a Python-based scanner with more than 1,300 penetration testing scripts aimed at platforms such as OpenSSL, Oracle WebLogic, WordPress, Jenkins and Apache Struts, was reachable through one of those domains as recently as September 9, 2026, and had been in use since around 2017. FishHub handled spear phishing and post-compromise malware delivery.
The scale came from an IoT botnet built on a Mirai variant and managed by an application called Sparrow. An FBI affidavit describes a database holding records for more than 1.2 million infected devices as of June 2024, including over 385,000 in the United States. Scanning targets named in the filings include a U.S. power company in South Carolina, a multinational NGO, airports in Japan and Poland, and Taiwanese natural gas, power and university networks. Confirmed FishHub victims included roughly 20 Taiwanese universities.
Why this is a GRC story
This is an enabler case, not a lone-hacker case. The indictment language is blunt about who did the work: a private company selling scanning and access capability to state clients. That reframes supply chain risk. The question stops being only "who is attacking us" and becomes "which commercial intermediaries are in the path," a question that vendor risk programs are rarely built to answer.
Disruption is not remediation. As the U.S. Attorney for the Western District of Pennsylvania noted, this is the second takedown of Integrity Tech infrastructure in two years. Capability that is rebuilt this quickly tells defenders that seizures buy time, not safety. The patch, the asset inventory and the internet-facing service review still have to happen on your side.
The advisory is the actionable part. Alongside the seizures, agencies from the U.S., U.K., Australia, Canada, Japan, New Zealand and Spain published a joint advisory with indicators of compromise. That document is the artifact a GRC team can actually use this week: map the indicators against logs, and record what you found or did not find.
What to watch
Watch whether the advisory produces measurable hunting activity in regulated sectors. Utilities and transport operators are named targets, and many of them carry reporting obligations that turn a detected indicator into a filed incident.
The practical move is unglamorous. Confirm you know every internet-facing service you own, that someone owns the patch decision for each one, and that scanning traffic against those services is logged long enough to investigate. Attackers using automated scanning for a decade are betting that nobody is watching the perimeter. Proving them wrong is cheap.
Attribution: Analysis based on The Hacker News, the Justice Department press release and related public reporting. This article is original commentary, not a repost of the source material.