The U.S. Federal Bureau of Investigation and Department of Justice took down seven internet domains and shut down platforms used by a Chinese state-sponsored hacking group to scan and breach American critical infrastructure. The agencies announced the disruption of malicious tools operated by Flax Typhoon, a threat group tied to Integrity Technology Group, a Beijing-based contractor working with the Chinese government. The seized domains include c0cc[.]cc, 98aiblog[.]com, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.
Court filings reveal that Integrity Tech built and ran an Internet of Things botnet powered by a version of the Mirai malware. A database server contained records for more than 1.2 million infected devices as of June 5, 2024, with over 385,000 unique U.S. victim devices among them. Approximately 260,000 devices worldwide—including roughly 126,000 in the United States—were actively compromised as of that same date. The botnet relied on a scanning tool called Microscan, hosted on "198.13.53[.]226" and accessible via the domain "c0cc[.]cc" as recently as September 9, 2026. The Python-based web tool, which authorities believe was deployed as early as 2017, features more than 1,300 penetration testing scripts designed to identify vulnerabilities in OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. Confirmed targets include a South Carolina power company, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese natural gas and power sector firms, and two Taiwanese universities. A second tool, FishHub, enabled intrusions through spear-phishing attacks and follow-on payload deployment, with 20 Taiwanese universities confirmed as victims.
U.S. Attorney Troy Rivetti for the Western District of Pennsylvania stated that "these state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims' vulnerabilities." The Justice Department said FishHub "provided Integrity Tech's clients with unauthorized remote access to the victim network or searched for specific files and sent them to servers controlled by Integrity Tech." FBI Cyber Division Assistant Director Brett Leatherman noted that "the PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity," adding that exposing these enablers makes it harder for China to target American networks. A joint advisory from cybersecurity agencies in the U.S., U.K., Australia, Canada, Japan, New Zealand, and Spain flagged Integrity Tech for building and selling cyber tools used to compromise organizations worldwide.
The advisory explains that since at least mid-January 2021, threat actors enabled by Integrity Tech have broken into victim networks and cloud services using Python- and Go-based command line utilities, while leveraging cross-site scripting attacks to harvest user credentials. The hackers installed SoftEther VPN software clients on victim devices to maintain persistent access and deployed EBurst, an open-source Python brute-force tool, to attack Microsoft 365 Cloud accounts and steal mailbox data using a utility called office-cli. The U.K. National Cyber Security Centre highlighted that malicious actors are "uniquely using AI tools, such as automated scanning, alongside large-scale botnets and manual exploitation techniques to compromise and steal confidential data from companies around the world, including critical sectors." The disruption comes alongside a State Department reward offer of up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks tracked as Silk Typhoon.
The takedown follows a September 2024 U.S. court-authorized operation that dismantled the Raptor Train botnet, which comprised thousands of compromised small office and home office devices linked to Flax Typhoon. By seizing the infrastructure and blocking access to scanning platforms, authorities aim to limit the reach of Chinese government-backed hacking operations that rely on third-party contractors to scale their intrusions. The coordinated international advisory signals a broader effort to expose and disrupt the ecosystem of for-profit companies that acquire or build offensive cyber tools for state actors. Organizations in critical infrastructure sectors face persistent scanning and exploitation attempts that combine automated tools with manual techniques, making defense a moving target that requires continuous vigilance and rapid response to emerging threats.