FBI Seizes Integrity Tech Domains Supporting China-Linked Cyberespionage

The FBI, CISA, NSA, and partners from six other countries issued a joint advisory detailing cyberespionage operations enabled by China-based Integrity Technology Group, which has links to the Chinese government. The actors targeted organizations worldwide, including U.S. government, critical manufacturing, healthcare, and IT entities, using automated vulnerability scanning, exploitation of known vulnerabilities, and credential attacks. Their tools included MicroScan for vulnerability discovery, disguised SoftEther VPN clients for persistent access, DC.exe for Active Directory credential theft, and utilities for stealing Microsoft Exchange and Microsoft 365 email. Investigators recovered stolen emails associated with government agencies, law enforcement organizations, healthcare systems, and religious institutions in Southeast Asia.

The U.S. Department of Justice and FBI announced the seizure of seven domains supporting Integrity Tech’s MicroScan and FishHub spear-phishing infrastructure on October 8, 2026. The disruption did not establish that existing compromises had been remediated, leaving affected organizations with a continuing need to investigate persistent access and credential theft. The activity overlaps with Flax Typhoon, Ethereal Panda, and Red Juliett, but the advisory cautioned against assigning all observed operations to those tracking labels. WaterISAC warned that utilities with vulnerable internet-facing systems could face similar exposure, although the advisory did not identify water and wastewater systems as targets.