FBI Seizes 7 Domains as 7 Governments Warn of Chinese Spies Stealing Data
FBI seizes seven domains tied to Integrity Technology Group as seven governments warn Chinese-linked actors are stealing sensitive data worldwide.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
The FBI has seized seven web domains tied to hacking tools allegedly run by a Chinese security firm called Integrity Technology Group, and a joint advisory from seven governments warns that Chinese government-linked attackers are using those tools to steal sensitive data worldwide.
The advisory, released October 8, 2026 and carrying alert code AA26-281A, was issued by the FBI, CISA, the NSA, the UK’s NCSC, Australia’s ASD’s ACSC, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s NCSC, and Spain’s CNI.
What the advisory says the attackers do
According to the advisory, the actors exploit vulnerabilities using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, then establish persistence through VPN software and exfiltrate emails and credentials using scripts.
The advisory names Integrity Technology Group, a China-based for-profit company with links to the Chinese government, as the enabler. It says the group employs people who acquire or build cyber tools for use and sale, acquire and host infrastructure, and compromise networks across global victims.
Targets included US critical infrastructure sectors — government services and facilities, critical manufacturing, healthcare and public health, and information technology — plus US law enforcement, education, and religious organizations, and organizations across Southeast Asia, Africa, and North America.
The seized domains and the botnet
The Register reports that the FBI announced the seizure of seven domains linked to hacking tools allegedly operated by Integrity Tech, and that court documents unsealed Thursday allege the firm has contracts with the PRC government.
According to The Register, Integrity Tech accessed its Microscan vulnerability scanner through one of the seized domains, c0cc[.]cc, and five others — 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net — delivered FishHub malware as recently as March, infecting about 20 Taiwanese universities.
The court documents allege Flax Typhoon actors used Microscan to scan the networks of a South Carolina power company, a multinational NGO, Japanese and Polish airports, and at least two Taiwanese critical infrastructure companies in the natural gas and power sectors, The Register reports. Victims also included a university in Hsinchu, Taiwan, compromised in March 2023, and a second university in Puli Township breached in August 2022.
“Based on my training and experience I believe the tool was named FishHub because it facilitated phishing activity,” FBI special agent Adam James said in a seizure warrant affidavit, according to The Register.
Five CVEs added to the known exploited list
CISA has added five CVEs to its Known Exploited Vulnerabilities Catalog based on this activity, according to The Register: CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894.
The advisory’s affected products list is longer, also naming CVE-2014-6278, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, and CVE-2023-22894.
What defenders are told to do
The advisory’s key actions are to disable unused services and ports such as automatic configuration, remote access, or file sharing protocols; sanitize user input in web applications to prevent cross-site scripting payload injection; implement identity, credential, and access management policies and require multifactor authentication for services where possible; and apply timely patches.
Downloadable indicators of compromise are published with the advisory in STIX XML and STIX JSON formats, alongside a PDF version of the report.
Related reading
Sources
- Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data — CISA Advisories
- US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide — The Register
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
