On October 8, 2026, the United States moved against a Chinese hacking contractor on two fronts at once. The Justice Department and FBI announced court-authorized seizures of domains behind two tools, "Microscan" and "FishHub," which they attribute to Integrity Technology Group, a company based in the People's Republic of China that, in the government's words, "has contracts with the PRC government." The same day, CISA, the FBI, the NSA and seven foreign partner agencies published advisory AA26-281A describing how actors enabled by the same company combine automated scanning with hands-on intrusion to take data from critical-infrastructure networks. Read together, the two documents show what domestic criminal process can accomplish against a state-linked operator, and where its reach ends.
What was seized, and under what authority
The press release describes Microscan as a reconnaissance tool run through a botnet of internet-of-things devices infected with a Mirai variant, used to find vulnerabilities that the company's clients would later exploit. FishHub supported spear phishing and, after an initial compromise, delivered follow-on malware that either gave remote access or searched for files and sent them to company-controlled servers. Targets scanned by Microscan included a power company in South Carolina, a multinational non-governmental organization, Japanese and Polish airports, and Taiwanese natural gas and power companies; confirmed FishHub victims included approximately 20 Taiwanese universities. The release calls this the Department's second public technical disruption of Integrity Tech, after the September 2024 operation against a botnet of more than 200,000 consumer devices.
The unsealed affidavit, sworn on October 6, 2026 in the Western District of Pennsylvania, shows the legal machinery. The FBI agent asserted probable cause that seven domain names were property used to commit or facilitate violations of 18 U.S.C. § 1030(a)(2)(C) (unauthorized access to obtain information) and § 1030(a)(5)(A) (intentional damage to a protected computer), plus conspiracy under 18 U.S.C. § 371, making them subject to seizure and criminal forfeiture under Rule 41(b), 18 U.S.C. § 1030(i) and 21 U.S.C. § 853(f). A second theory treated the domains as property involved in an international promotional money-laundering conspiracy under 18 U.S.C. § 1956, on the basis that funds used to buy and renew them, paid in Chinese yuan through Alipay and through a Hong Kong credit card, moved from outside the United States into it to promote computer-intrusion offenses. That theory opened civil forfeiture under 18 U.S.C. § 981(a)(1)(A).
The mechanism of seizure is notable for what it is not. Unlike the botnet operations that have drawn scrutiny for reaching into victims' devices, this warrant was directed at a registry. Verisign, which administers the .com, .net and .cc top-level domains from Reston, Virginia, was ordered to point the domains at FBI-designated name servers, and the Phoenix-based registrars were ordered to lock them pending transfer to the United States after forfeiture. Jurisdiction rested not on the operators' presence but on the location of the infrastructure they rented.
The advisory and the contractor model
AA26-281A, co-sealed by ten agencies across seven countries including Japan's National Police Agency and Spain's intelligence service, characterizes Integrity Tech as "a China-based for-profit company with links to the Chinese government" that acquires or builds tools, hosts infrastructure, and supports network compromises worldwide. It says the company enables China-linked actors whose tactics are consistent with activity the private sector tracks as Flax Typhoon, Ethereal Panda and Red Juliett, while cautioning that vendor naming schemes do not map one-to-one onto U.S. government tracking. The listed sectors are Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The advisory states that its information originates from evidence recovered during multiple FBI investigations, and it frames mitigations around the Cross-Sector Cybersecurity Performance Goals rather than naming any legal action.
The affidavit adds a detail that bears on attribution: the FBI traced a botnet-management application's user guide and source code to "KRlab," which it identified as a sub-division of Integrity Tech through the company's own public website. That is a corporate attribution, built on business records and infrastructure purchases, rather than an attribution to a specific ministry. Beyond the contract sentence, the release's most specific statement on the state relationship is FBI Cyber Division Assistant Director Brett Leatherman's remark that "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity."
Earlier cases filled in more of that model. The March 2025 indictment of eight i-Soon employees and two Ministry of Public Security officers alleged that the MSS and MPS used a network of private companies, that some hacks were commissioned and many were speculative, that i-Soon sold or tried to sell stolen data to at least 43 MSS or MPS bureaus in at least 31 provinces and municipalities, and that it charged roughly $10,000 to $75,000 per compromised email inbox. The Integrity Tech affidavit does not allege that level of detail, and the advisory does not claim ministry direction. The attribution is therefore layered: firm on the company, hedged on the state.
What criminal process can and cannot do
The October action shows three things domestic process does well: it denies infrastructure, because registries and registrars are within reach; it creates a public evidentiary record reviewed by a magistrate; and it can be coordinated with partners, as the Japanese assistance credited in the release shows.
Its limits are equally visible. No individual was charged in the October release, and in the i-Soon case all ten defendants, as the Department itself noted, remain at large. The contractor model absorbs this: a company that rents servers and domains can rent new ones, and the affidavit itself notes that FishHub was hosted on a server the affidavit attributes to Flax Typhoon as of March 2026, well after the 2024 botnet disruption.
Custody is occasionally obtained. In April 2026, Xu Zewei, allegedly an employee of Shanghai Powerock, one of what the Department called "many 'enabling' companies," was extradited from Italy to face a nine-count indictment in Houston for intrusions the FBI says were directed by the Shanghai State Security Bureau. His co-defendant remains at large. The pattern is that contractors who travel can be reached; the firms and the officers behind them generally cannot.
Analysts have questioned both the durability and the measurability of disruption. Gavin Wilde and Emma Landi at the Carnegie Endowment noted in 2024 that law-enforcement agencies "lack the jurisdiction to simply swoop into another country," that there is no standard metric for a takedown's success, and that some groups rebuild within months. They also noted legal scholars' warning that remote-access operations under the 2016 revision of Rule 41 "may not survive future legal challenges absent legislative backing," and they called for clearer criteria and legislative guidance. The registry-based seizure used here avoids the most contested feature of those operations, the modification of code on victims' devices, but it leaves open whether episodic disruption changes a contractor's economics.
The emerging pattern
The October 2026 action fits a sequence: botnet disruption in 2024, indictments and domain seizures against i-Soon in 2025, an extradition in April 2026, and now a second strike against Integrity Tech paired with a seven-country advisory. The legal tools are familiar criminal statutes and forfeiture provisions applied to rented infrastructure. What has changed is the target: not a ministry, which cannot be reached, nor an individual, who usually cannot be found, but the commercial layer in between. Whether that layer is thin enough to matter is the question the next disruption will test.
Sources
- Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated by PRC-Based Company — justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated
- Affidavit in Support of an Application for Seizure Warrants, Magistrate No. 26-1564 (W.D. Pa. Oct. 6, 2026) — justice.gov/usao-wdpa/media/1464921/dl?inline=
- Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (AA26-281A) — cisa.gov/news-events/cybersecurity-advisories/aa26-281a
- Justice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion Campaigns — justice.gov/opa/pr/justice-department-charges-12-chinese-contract-hackers-and-law-enforcement-officers-global
- Prolific Chinese State-Sponsored Contract Hacker Extradited from Italy — justice.gov/opa/pr/prolific-chinese-state-sponsored-contract-hacker-extradited-italy
- Exploring Law Enforcement Hacking as a Tool Against Transnational Cyber Crime — carnegieendowment.org/research/2024/04/exploring-law-enforcement-hacking-as-a-tool-against-transnational-cyber-crime?lang=en