US seizes seven domains linked to alleged Chinese cyber espionage tools
The US Department of Justice and FBI have seized seven domain names allegedly used to operate two cyber tools linked to China-based Integrity Technology Group. The operation targeted infrastructure supporting vulnerability scanning and spear-phishing, amid allegations of attacks against critical infrastructure and other networks in the United States, Asia and Europe.
US authorities have seized seven domain names associated with two alleged cyber espionage tools, aiming to disrupt the online infrastructure used to operate them. The Department of Justice and the FBI announced the court-authorised action on 8 October 2026.
The targeted services, known as Microscan and FishHub, allegedly supported different stages of cyber intrusions. According to the US government, Microscan was used to scan networks for security weaknesses, while FishHub enabled spear-phishing campaigns aimed at specific recipients. Investigators allege that actors working for China-based Integrity Technology Group used the tools to identify vulnerable systems and gain unauthorised access to networks.
The alleged targets included critical infrastructure, such as power and transport systems, as well as other networks in the United States, Asia and Europe. However, the extent of any successful compromises and the identities of affected organisations have not been independently established.
The operation focused on the domain names supporting the two services. Disabling or redirecting these domains can prevent users from reaching the associated tools through their usual internet addresses. The court affidavit identifies seven domains, although the Justice Department’s public announcement names six.
The impact of the seizures will depend on how closely the tools rely on the affected domains. Domain seizures do not necessarily remove the underlying servers or eliminate the operators’ capabilities. The services could potentially resume through replacement domains, alternative hosting or changes to their domain name system (DNS) configurations.
Alongside the operation, the FBI issued a cybersecurity advisory on 8 October to help network defenders identify and respond to the alleged activity. The guidance forms part of the broader effort to disrupt the services and help organisations detect related threats.
The allegations against Integrity Technology Group and claims about the targeting of networks remain those of US authorities. It is not yet independently established whether the seizures have permanently disabled Microscan and FishHub or interrupted their operations temporarily.
