Secure Critical Infrastructure Against Seized Microscan and FishHub Tools
US authorities seized hacking tools linked to Integrity Tech, exposing risks to global critical infrastructure and IoT devices.
Key points
- DOJ and FBI seized Microscan and FishHub tools linked to China-based Integrity Tech.
- The tools targeted critical infrastructure using a botnet of over 1.2 million infected IoT devices.
- Microscan ran penetration scripts against OpenSSL, WordPress, Jenkins, and Apache Struts vulnerabilities.
The US Department of Justice and the FBI announced the seizure of two hacking tools, Microscan and FishHub, this week. These tools were operated by Integrity Technology Group, a Beijing-based company with direct contracts with the Chinese government. The operation aims to deny malicious actors access to infrastructure used for scanning and breaching critical systems worldwide.
The risk
Integrity Tech, also linked to hacking groups Flax Typhoon, Ethereal Panda, and RedJuliett, used these tools to conduct widespread reconnaissance. Microscan, accessed via the domain c0cc.cc, executed more than 1,300 penetration testing scripts. These scripts targeted known weaknesses in specific software components, including OpenSSL, WordPress, Jenkins, and Apache Struts. The tool remained active and reachable as recently as September 9.
Who is exposed
Critical infrastructure across multiple countries faced direct scanning and, in some cases, unauthorized access. The botnet powering Microscan consisted of infected Internet of Things devices running a variant of Mirai malware. According to The Hacker News, the botnet database held records for over 1.2 million devices in June 2024. Of those, more than 385,000 were located in the United States.
Cost and compliance
At the time of the review in June 2024, approximately 260,000 devices were actively infected within the botnet. This included about 126,000 devices in the US. Assistant US Attorney Troy Rivetti noted this was the second disruption of Integrity Tech’s operations in two years. The case highlights that seizing infrastructure does not necessarily halt a group’s activities permanently.
Our take on the response
The seizure of Microscan and FishHub removes immediate access for Integrity Tech but does not eliminate the underlying vulnerabilities exploited by their scripts. Security teams must treat the exposure of these tools as a confirmation that their environments are likely being scanned. Proactive patching of the named software versions is essential to mitigate the risk of similar tools being deployed by other actors.
What to do and how to stay safe: Microscan
- Audit all internet-facing systems for outdated versions of OpenSSL, WordPress, Jenkins, and Apache Struts.
- Monitor network logs for traffic originating from or destined to known malicious domains like c0cc.cc.
- Review IoT device security policies to ensure firmware is updated and default credentials are changed.
- Verify that intrusion detection systems are configured to alert on penetration testing script signatures.
Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What tools were seized by US authorities?
The DOJ and FBI seized Microscan and FishHub, hacking tools operated by Integrity Technology Group.
Which software vulnerabilities did Microscan target?
Microscan ran scripts targeting weaknesses in OpenSSL, WordPress, Jenkins, and Apache Struts.
How many IoT devices were in the botnet?
The botnet database contained records for more than 1.2 million infected devices in June 2024.
