US Authorities Disrupt Major Chinese State-Sponsored Cyber Infrastructure Linked to Integrity Technology Group

The impact of FishHub was particularly felt in Taiwan’s education sector. Investigations have confirmed that approximately 20 Taiwanese universities were victims of this tool. The targeting of academic institutions is a common hallmark of state-sponsored espionage, as these organizations often hold valuable intellectual property, research data, and personal information on future leaders and policy-makers.

International Cooperation and the Global Threat

The exposure of Integrity Tech’s operations has drawn sharp condemnation from international cybersecurity leaders. Paul Chichester, Director of Operations at the UK’s National Cyber Security Centre (NCSC), underscored the gravity of the findings. "The extensive malicious cyber activities, and services by Integrity Tech, that have been exposed today should be extremely concerning for all network defenders," Chichester said. He noted that the breadth of sectors targeted across the globe—from energy and transportation to academia—demonstrates that no organization is entirely safe from such sophisticated actors. "All organizations should take note of this warning," he added.

This is not the first time Integrity Tech has faced international scrutiny. Last year, the UK government took the formal step of sanctioning the company, along with another China-based firm known as i-Soon, for their involvement in malicious cyber activities. These sanctions were part of a broader effort to hold the PRC accountable for its state-sponsored hacking campaigns and to disrupt the financial and operational capabilities of the contractors that support them.

The Western District of Pennsylvania has been a focal point for the legal side of this disruption. Attorney Troy Rivetti, representing the district, emphasized the persistent nature of the threat. "These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims’ vulnerabilities," Rivetti stated.

He noted that this recent seizure is the second major disruption of Integrity Tech’s operations in as many years, signaling a sustained commitment by US law enforcement to combat these threats. "These seizures… send another clear message to cybercriminals from the PRC and elsewhere of the department’s dedication to defending and maintaining cybersecurity in the United States and abroad."

As the FBI and its international partners continue to analyze the data recovered from the seized domains, the focus remains on identifying and notifying additional victims. For network defenders, the disruption of Microscan and FishHub provides a temporary reprieve, but officials warn that the underlying threat remains. The PRC’s sophisticated network of contractors is resilient, and new tools and domains are likely already in development.

The message from the Department of Justice is clear: the United States will continue to use every tool at its disposal—from technical disruptions to international sanctions—to protect its critical infrastructure and the integrity of the global digital economy. For organizations worldwide, the exposure of Integrity Tech serves as a stark reminder of the need for robust, proactive cybersecurity measures to defend against an adversary that is both highly skilled and relentlessly persistent.