Washington Repoed the Hacker Tool Shed

Evidence locker | October 8, 2026. Washington brought a padlock to the cyber press conference.

DOJ and FBI announced court-authorized seizures of seven domains to deny operators access to Microscan and FishHub. Court filings allege actors working for China-based Integrity Technology Group, which has PRC government contracts, operated and used the tools.^[1][2]

AP reports that officials described the tools as inoperable.^[3]

Inside the shed

• Microscan: vulnerability scouting, including through a Mirai-based botnet. DOJ lists a South Carolina power company and airports in Japan and Poland among the scanning targets.
• FishHub: spear-phishing and follow-on malware. DOJ identifies roughly 20 Taiwanese universities as confirmed victims.^[2]

Keep that distinction in your gulliver: being scanned does not, by itself, establish a successful intrusion.

Keep the champagne locked up

DOJ calls this its second public technical disruption of Integrity Tech’s hacking infrastructure, following a 2024 botnet operation involving more than 200,000 consumer devices. AP also reports that the FBI will watch for efforts to rebuild.^[2][3]

A seized domain creates a problem for its operator. How expensive that problem becomes depends on what it takes to rebuild. This operation does not establish that the broader campaign is finished.

Watch how quickly access returns, how much rebuilding exposes, and whether defenders close the doors meanwhile. The glorious victory PDF can wait until there’s evidence the bill is getting harder to pay.