US Authorities Disrupt Major Chinese State-Sponsored Cyber Infrastructure Linked to Integrity Technology Group

In a significant blow to state-sponsored cyber espionage operations, the United States Department of Justice and the Federal Bureau of Investigation (FBI) have announced the successful seizure of several domains used by a prominent Chinese cyber-espionage contractor. The operation targeted the digital infrastructure of Integrity Technology Group, a firm deeply embedded within the Chinese government’s offensive cyber ecosystem. By taking control of these domains, federal authorities have effectively disrupted access to a pair of sophisticated hacking tools that have been instrumental in compromising critical infrastructure and corporate networks on a global scale.

The disruption marks a pivotal moment in the ongoing effort to dismantle the technical foundations used by the "Flax Typhoon" cybercrime group. Also known by various aliases such as Ethereal Panda and Red Juliett, this threat actor has long been a primary concern for Western intelligence agencies. The group is characterized by its systematic targeting of high-value sectors, including telecommunications, energy, and government services, often acting on behalf of the People’s Republic of China (PRC) to facilitate intelligence gathering and maintain a persistent presence within foreign networks.

Central to the FBI’s operation were two primary tools: Microscan and FishHub. According to investigators, these utilities were the "bread and butter" of the group’s operations, providing the means to both identify vulnerabilities and maintain unauthorized access to victim systems. The seizure of the domains associated with these tools is expected to significantly hamper the group’s ability to conduct large-scale reconnaissance and manage its sprawling network of compromised devices.

The Role of Integrity Technology Group

Integrity Technology Group, the entity at the heart of this disruption, represents a growing trend in the landscape of international cyber warfare: the state-sponsored contractor. Based in China, the company maintains formal contracts with the Chinese government, acting as a private-sector arm for state-level espionage. This model allows the PRC to scale its operations rapidly, leveraging the expertise of private security firms to conduct widespread campaigns while maintaining a degree of plausible deniability.

The activities of Integrity Tech have been tracked across multiple major campaigns. Security researchers have linked the company’s infrastructure to several high-profile Advanced Persistent Threat (APT) groups. While "Flax Typhoon" is the most prominent name associated with this activity, the group’s footprints are also found in operations labeled as Ethereal Panda and Red Juliett. These groups are known for their technical agility, moving between different sets of tools and infrastructure to evade detection.

Assistant Director Brett Leatherman of the FBI’s Cyber Division highlighted the strategic importance of targeting these contractor-led operations. "Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting US and foreign critical infrastructure," Leatherman stated. He emphasized that the PRC’s reliance on these enabling companies is a vulnerability that Western law enforcement is increasingly keen to exploit. "By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure."

A Multi-Faceted Tactical Approach

The threat actors associated with Integrity Tech do not rely on a single method of entry. Instead, they employ a sophisticated and unique combination of tactics designed to maximize their reach while minimizing their visibility. One of the most effective components of their strategy is the use of large-scale botnets. By compromising thousands of consumer-grade devices—such as routers and IoT hardware—the group creates a massive, distributed network that can be used to launch attacks and relay traffic, making it extremely difficult for defenders to trace the activity back to its source.

In addition to botnets, the group makes extensive use of virtual private network (VPN) infrastructure and "living off the land" (LOTL) techniques. LOTL involves using legitimate system tools and administrative software already present on a victim’s network to carry out malicious actions. Because these tools are trusted by the operating system, their use often bypasses traditional antivirus and endpoint detection software. When combined with a repository of proprietary computer network exploitation (CNE) tools, this approach creates a formidable challenge for even the most well-equipped security teams.

The development and deployment of Microscan and FishHub fit perfectly into this tactical framework. Microscan, a Python-based web application, served as the group’s primary reconnaissance engine. It was not merely a simple scanner; it contained a library of over 1,300 penetration testing scripts. These scripts were meticulously written to probe websites and servers for specific, known vulnerabilities.

The scope of Microscan’s targeting was vast. The threat actors used the tool to hunt for weaknesses in a wide variety of services and platforms, including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. By automating the search for these vulnerabilities, Integrity Tech could identify potential targets at an industrial scale, allowing their clients to strike whenever a high-value opportunity presented itself.

The victims of these scanning operations spanned the globe, illustrating the indiscriminate nature of the group’s reconnaissance. In the United States, targets included a power company based in South Carolina, raising serious concerns about the security of the nation’s energy grid. Beyond US borders, the group targeted a multi-national non-governmental organization (NGO), as well as critical transportation hubs like Japanese and Polish airports. In Taiwan, the focus was even more intense, with the group targeting critical infrastructure companies in the natural gas and power sectors, alongside two major universities.

Spear phishing campaign targeted corporate networks

While Microscan was used to find the "doors" into a network, the second tool, FishHub, was designed to walk through them. FishHub played a critical role in the exploitation phase of the group’s operations, often following an initial compromise achieved through spear phishing. These targeted email attacks would trick employees into clicking malicious links or downloading attachments, providing the initial foothold the attackers needed.

Once a network was compromised, FishHub would be deployed to download additional malware, effectively turning the initial breach into a permanent backdoor. This gave Integrity Tech’s clients unauthorized remote access to the victim’s environment, allowing them to move laterally through the network to find sensitive data. FishHub was also equipped with specialized search functions, enabling it to locate specific files and exfiltrate them to servers controlled by the group.

The impact of FishHub was particularly felt in Taiwan’s education sector. Investigations have confirmed that approximately 20 Taiwanese universities were victims of this tool. The targeting of academic institutions is a common hallmark of state-sponsored espionage, as these organizations often hold valuable intellectual property, research data, and personal information on future leaders and policy-makers.

International Cooperation and the Global Threat

The exposure of Integrity Tech’s operations has drawn sharp condemnation from international cybersecurity leaders. Paul Chichester, Director of Operations at the UK’s National Cyber Security Centre (NCSC), underscored the gravity of the findings. "The extensive malicious cyber activities, and services by Integrity Tech, that have been exposed today should be extremely concerning for all network defenders," Chichester said. He noted that the breadth of sectors targeted across the globe—from energy and transportation to academia—demonstrates that no organization is entirely safe from such sophisticated actors. "All organizations should take note of this warning," he added.

This is not the first time Integrity Tech has faced international scrutiny. Last year, the UK government took the formal step of sanctioning the company, along with another China-based firm known as i-Soon, for their involvement in malicious cyber activities. These sanctions were part of a broader effort to hold the PRC accountable for its state-sponsored hacking campaigns and to disrupt the financial and operational capabilities of the contractors that support them.

The Western District of Pennsylvania has been a focal point for the legal side of this disruption. Attorney Troy Rivetti, representing the district, emphasized the persistent nature of the threat. "These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims’ vulnerabilities," Rivetti stated.

He noted that this recent seizure is the second major disruption of Integrity Tech’s operations in as many years, signaling a sustained commitment by US law enforcement to combat these threats. "These seizures… send another clear message to cybercriminals from the PRC and elsewhere of the department’s dedication to defending and maintaining cybersecurity in the United States and abroad."

As the FBI and its international partners continue to analyze the data recovered from the seized domains, the focus remains on identifying and notifying additional victims. For network defenders, the disruption of Microscan and FishHub provides a temporary reprieve, but officials warn that the underlying threat remains. The PRC’s sophisticated network of contractors is resilient, and new tools and domains are likely already in development.

The message from the Department of Justice is clear: the United States will continue to use every tool at its disposal—from technical disruptions to international sanctions—to protect its critical infrastructure and the integrity of the global digital economy. For organizations worldwide, the exposure of Integrity Tech serves as a stark reminder of the need for robust, proactive cybersecurity measures to defend against an adversary that is both highly skilled and relentlessly persistent.