US Disrupts China‑Linked Integrity Tech’s Cyber‑Espionage Tools Used Against Global Critical Infrastructure
What Happened — The U.S. Department of Justice and FBI seized two China‑origin hacking tools, Microscan and FishHub, that were built and operated by Integrity Technology Group. The tools leveraged a Mirai‑based IoT botnet of over 1.2 million compromised devices (≈385 k in the United States) to scan and, in many cases, break into critical‑infrastructure networks worldwide.
Why It Matters for Trust & Control Assurance
- The incident illustrates a supply‑chain risk where a third‑party provider supplies malicious scanning and exploitation capabilities that can be turned against any organization.
- Continuous vendor‑risk monitoring and evidence collection are essential to detect and block such tools before they reach your environment.
- Demonstrating a defensible audit trail of third‑party oversight satisfies multiple control objectives across frameworks (e.g., NIST CSF 2.0 supply‑chain risk management).
Who Is Affected – Energy & utilities, transportation, NGOs, and other critical‑infrastructure operators worldwide; any organization that relies on IoT devices or external scanning services.
Recommended Actions
- Map the “third‑party risk oversight” control to your audit‑readiness program and collect evidence of vendor vetting, continuous monitoring, and incident‑response readiness.
- Inventory all external scanning tools and IoT devices; enforce strict network segmentation and baseline monitoring for anomalous traffic.
- Review contracts with vendors that have access to your network for clauses requiring security certifications and real‑time threat‑intelligence sharing.
Technical Notes – Microscan accessed a domain (c0cc.cc) to run 1,300+ penetration‑testing scripts targeting known weaknesses in OpenSSL, WordPress, Jenkins, and Apache Struts. FishHub was a botnet controller built on Mirai code, with >260 k actively infected devices at the time of seizure. Source: Security Affairs