The FBI seized the domains a China-linked botnet used to scan and phish

On October 8, 2026, the Justice Department and the FBI announced that a court in the Western District of Pennsylvania had authorized the seizure of seven domain names. The domains were how operators at Integrity Technology Group, a Beijing company, reached two of their own tools. One tool, Microscan, scanned other people’s networks for known holes. The other, FishHub, sent spear-phishing mail and then pulled more software onto machines that had already been opened. A Mirai botnet of hacked routers, cameras, and recorders had been used to hide where some of those scans came from.

The announcement is easy to misread as a new takedown of that botnet. The botnet’s command channel was cut on September 11, 2024. What the FBI took this month are the names on the internet that still pointed at the scanner and the phishing delivery. An affidavit unsealed with the warrants says the Microscan login page was still up on September 9, 2026.

The allegations are probable cause in a seizure warrant, sworn by FBI Special Agent Adam James on October 6 before Magistrate Judge Maureen P. Kelly. They are not a conviction. The numbers below are the ones in that affidavit, the October 8 press release, and the joint advisory published the same day. Where those three disagree, both figures are here.

Seven names, and what a seizure actually does

The warrant, Magistrate No. 26-1564, lists the domains in one block:

• c0cc[.]cc
• 98aiblog[.]com
• 98aicai[.]com
• 98aicode[.]com
• outlook3650[.]com
• youtubecard[.]com
• linkedinns[.]net

The press release names six of them and sorts them by tool. c0cc[.]cc is how Integrity Tech opened Microscan. The five lookalikes, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net, are what FishHub used to deliver the next program. The seventh, 98aiblog[.]com, is the one the press release does not put in either sentence. The affidavit puts it on the SoftEther VPN that two compromised Taiwanese universities used to call back.

Three of those names are doing a cheap kind of camouflage. outlook3650 is one character off a Microsoft product. youtubecard borrows YouTube. linkedinns borrows LinkedIn and adds a letter. A person skimming a link, or a filter written for the real names, can miss them. The affidavit does not claim the real companies had anything to do with the registration.

A domain seizure is a change in the phone book, not a raid on a room full of servers. The two registrars that sold the names are headquartered in Phoenix. Verisign, in Reston, Virginia, runs the .com, .net, and .cc registries. The warrant tells Verisign to point the names at name servers the FBI designates, starting with ns1.fbi.seized.gov and ns2.fbi.seized.gov, and to refuse transfers. The page a visitor then gets is a seizure banner. The banner on the warrant says the action addresses cyber threat actors known as Integrity Technology Group, under a warrant for damaging a protected computer, 18 U.S.C. § 1030(a)(5)(A).

The affidavit also charges the names as property involved in moving money into the United States to promote that intrusion, 18 U.S.C. § 1956(a)(2). The payment trail is part of why the names could be seized quickly: domains can be pointed somewhere else in minutes, which is the reason the agent gives for wanting a warrant rather than waiting on a slower forfeiture case.

c0cc[.]cc was first registered on November 7, 2018, and renewed on August 31, 2024, both times in Chinese yuan through an Alipay account the affidavit names as Yuxin Ling, with a Beijing address. 98aiblog[.]com, 98aicai[.]com, and 98aicode[.]com were bought on March 13, 2024, in a $139.50 batch of five names, on a registrar account the affidavit calls asdown3389. The card behind that payment is a Hong Kong credit card, and the affidavit says the financial-services account is registered to Lin Kunzhong, with a Hong Kong billing address. The IP used for the purchase geolocates to Taipei. That identifies a payer on a record. It does not, by itself, identify who wrote the tools.

outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net were registered on February 18, 2025, on a second account, d527a8, also with a Hong Kong address. In February 2026 both registrar accounts were reached from 66.42.60[.]242 and the five FishHub names were renewed with AliPay. The same virtual-server account that leased 66.42.60[.]242 also leased 108.61.181[.]104, the server the SoftEther clients called. That is the affidavit’s reason for treating the names as one operator’s.

The company, and the three public names for the activity

Integrity Technology Group is a Beijing cybersecurity company. The FBI’s affidavit says its public site, integritytech.com[.]cn, carried the brand KRLab, and that KRLab was a subdivision of the firm. The firm has contracts with the Chinese government. The September 2024 Justice Department announcement called it publicly traded. On January 3, 2025, the Treasury Department’s Office of Foreign Assets Control sanctioned Integrity Technology Group, Incorporated, under the cyber sanctions program, for intrusion activity publicly attributed to Flax Typhoon. OFAC’s listing gives an establishment date of September 2, 2010, a Haidian District address, and the equity ticker 688244 CH.

Private-sector names for the activity are not one person. The joint advisory, AA26-281A, says the tactics line up with what has been published as Flax Typhoon, Ethereal Panda, and Red Juliett, and then says the match is not one-to-one. Actors who fit those descriptions also do work the advisory does not tie to Integrity Tech. Cybersecurity companies and the U.S. government do not draw the boundaries the same way. “Flax Typhoon” in the press release is the FBI’s use of the private-sector label for this company’s tools, including the Mirai botnet. It is not a finding that every report ever filed under that name was this warrant.

Microsoft’s description, which the 2024 Justice Department release says the FBI corroborated, is a China-based group active since 2021, interested in government, education, critical manufacturing, and information technology in Taiwan and elsewhere. The FBI’s own finding in that case was successful intrusion against U.S. and foreign corporations, universities, government agencies, telecommunications providers, and media organizations.

Assistant Attorney General John A. Eisenberg’s line in the October 8 release is the policy claim: the United States will not allow China or its proxies to operate against U.S. interests with impunity, and the National Security Division will keep disrupting Flax Typhoon infrastructure. U.S. Attorney Troy Rivetti, for the Western District of Pennsylvania, calls the seizures the department’s second disruption of Integrity Tech in as many years. FBI Cyber Division Assistant Director Brett Leatherman’s version, on the CISA announcement the same day, is the structural one: the PRC relies on contractor and enabling companies, and Integrity Tech is one of them.

The investigation sits with FBI San Diego and Baltimore, coordinated by the FBI’s Cyber Division. The prosecutors named on the release are Assistant U.S. Attorney Brendan McKenna in the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery in the National Security Division’s National Security Cyber Section, with help from Assistant U.S. Attorney Thomas Sullivan in the District of Maryland and from Japan’s National Police Agency.

What the botnet was, and what September 2024 actually turned off

Mirai is a family of malware for small internet-connected devices: office and home routers, IP cameras, digital video recorders, network-attached storage. A copy that phones home can be told to scan, to attack, or to relay someone else’s traffic so the victim sees a nearby address instead of a data center in another country. The affidavit’s variant did that job for Integrity Tech from about July 23, 2021, until about September 13, 2024.

In May 2024 the FBI looked at samples that private companies had uploaded to a malware repository and found command servers on subdomains of w8510[.]com. In July 2024, traffic collected under a pen-register order showed those servers managing thousands of bots. The virtual servers had a naming habit. The subscriber labeled them with kehu, the pinyin for 客户, “customer” or “client,” plus a number. The affidavit reads kehu1036 as client 1036. The money to lease them moved from China to a virtual-server company in West Palm Beach, Florida.

One of those machines, 202.182.109[.]151, named kehu1036jp4, was an upstream controller. It ran an application called Sparrow. Sparrow’s database, as of about June 5, 2024, held records of over 1.2 million infected devices, including over 385,000 unique devices in the United States. Over 260,000 of the records, including about 126,000 U.S. devices, were actively infected that day. The user guide’s first line said KRLab would provide ten real-world nodes for testing. The source used filenames that contained “KRlab.”

The public figure from the disruption is smaller and later. The Justice Department’s September 2024 announcement, which the State Department’s January 3, 2025 sanctions note dates to September 18, said the botnet was more than 200,000 consumer devices in the United States and worldwide. The affidavit’s June 5 snapshot is a database count of records and of devices then active. The press figure is the number the department used when it announced the disruption. They are not the same measurement, and the affidavit does not show the arithmetic that turns 260,000 active into “more than 200,000.” Quote the sentence you mean.

On September 11, 2024, under warrants from the same district, the FBI seized w8510[.]com, logged into the command servers, changed the settings so the botnet’s administrators could not get back in, and sent a command that cut the channel between those servers and the infected devices. Two infected devices in the Western District of Pennsylvania are what placed the case there. The malware on a camera does not have to vanish for that command to matter. The command stops that server from giving the camera new orders. A device that still has the variant on it is still a compromised device. It is no longer a working part of this particular network.

Microscan was a website full of other people’s bugs

Microscan is a Python web application. The joint advisory says it has been in use since at least 2017 and holds more than 1,300 scripts aimed at specific vulnerabilities, including in OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. An operator logs in, points it at a network, and gets back a list of holes. The advisory’s Figure 1 is that dashboard.

The FBI found it running on 198.13.53[.]226. Servers named with the kehu1036 pattern took scan jobs from that machine. Sometimes they sent the scan out through the Mirai bots, so the target’s logs showed a router in some other country instead of the scanner’s own address. On September 9, 2026, open-source checking by the FBI found the same login page still served at x.c0cc[.]cc. Cloudflare records from July 13, 2025, and the virtual-server company records from June 3, 2026, showed traffic for that name going to 198.13.53[.]226. Other names under c0cc[.]cc resolved to servers leased by the same account.

The scans the affidavit walks through are older than the login page’s last sighting. Between April 26 and December 29, 2022, Microscan was aimed at a U.S. power company in South Carolina, a multinational NGO, airports in Japan and Poland, and at least two Taiwanese companies in natural gas and power. A university in Hsinchu was scanned on March 21, 2023, and compromised soon after. A university in Puli Township was scanned on August 7, 2022, and compromised soon after. Those two are Victim 1 and Victim 2 in the warrant. The press release lists the same organizations and adds that the targets include two Taiwanese universities, which is these two. “Scanned” and “compromised” are different sentences in the affidavit. The power company, the NGO, the airports, and the Taiwanese utilities are in the scanning paragraph. The two universities are in the paragraph that says the intrusion succeeded.

FishHub sent the second program, and SoftEther kept the door open

FishHub, as of March 2026, was on 207.148.92[.]220, a server the affidavit says Flax Typhoon purchased. The agent’s reading of the name is that it existed to phish. The source on that server told a victim machine to download a file from one of the five lookalike domains and run it. The FBI’s analysis of what came next is a file listing, a search for particular documents, compression, and a send back to 207.148.92[.]220. The press release’s plainer version is the same pipeline plus a second use: remote access for Integrity Tech’s clients, or a search that forwards chosen files to servers the company controls.

The server held data and files from more than 20 entities. Commands on it showed that six of the targeted entities were universities in Taiwan. The October 8 press release says confirmed FishHub victims included approximately 20 Taiwanese universities. Both sentences are published. The affidavit’s “more than 20” is entities of any kind, with six universities visible in the commands the agent describes. The press release’s “approximately 20” is universities, and it calls them confirmed. The warrant does not show the list that would let a reader turn one number into the other.

Victim 1 and Victim 2 show the other half of staying inside. By August 12, 2024, the Hsinchu university had SoftEther installed, a legitimate VPN product, and that client used a subdomain of 98aiblog[.]com to connect to 108.61.181[.]104. On August 19, 2024, the Puli university’s SoftEther client used the same subdomain to reach the same address. The advisory’s general description of this habit matches the warrant’s specifics. The operators download SoftEther with PowerShell on Windows and with curl or wget on Linux, set it to reconnect at startup, and often name the installer conhost.exe or dllhost.exe, which are real Windows programs. A security product is less eager to delete a VPN that lots of organizations install on purpose. The advisory lists 98aiblog[.]com among the names that hosted those connections, next to others (hmbcloud[.]com, hmbcloud[.]net, twimg.co[.]uk, and several more) that this warrant does not seize.

What the advisory adds, beyond the two tools

AA26-281A is the same day’s technical note, from the FBI, CISA, the NSA, the United Kingdom’s NCSC, the Australian Signals Directorate’s ACSC, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s NCSC, and Spain’s Centro Nacional de Inteligencia. It is written for defenders. It is not a second copy of the warrant.

The scanning is not only Microscan. The operators also use ordinary tools: BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and wpscan. The ports they concentrate on are 21, 22, 53, 80, 443, and 1080. On websites they enumerate PHP and ASP.NET pages. The advisory’s reading of that toolkit is that the operators would rather find an already-vulnerable target than build a new exploit for a patched one.

The vulnerabilities the advisory says were recovered from the Microscan scripts are old on purpose. They are the kind of bug that survives on a device nobody updates:

Several rows in the advisory’s table carry an asterisk. The fetched text does not define it. The table’s own “what it allows” column is enough to see the pattern: file read, file write, or a command, on software that has had a fix for years.

After a foothold, the advisory describes a cross-site scripting payload that rewrites a page into a username and password form, then offers a password-protected zip. Inside is live700_v1.exe, which starts a process named DiagTrack.exe (a real Windows name) and talks, over HTTP, to dns.studiocloud[.]xyz, a domain the FBI attributes to Integrity Tech. The executable can query mailboxes. The FBI’s assessment is that the point is email.

EBurst, an open-source Python tool, sprays and guesses passwords against Microsoft 365 and Exchange. The interfaces the advisory tells defenders to watch are the Exchange Control Panel, Exchange Web Services, the Offline Address Book, Outlook Web Access, RPC, the API, MAPI, PowerShell, Autodiscover, and ActiveSync. A later command-line tool, office-cli, uses a real application registration (client_id, tenant_id, a secret) to pull mail over time. Stolen mail is also offered through a custom web app. In some cases access to the stolen mail was limited to IP addresses in Xiamen.

A PHP script the FBI calls Curlc4.txt speaks Exchange Web Services, compresses mail, and sometimes encrypts it with RC4 or AES-128-CBC before upload to natcloudservice[.]com. The advisory prints strings from that script, including a password and a key. Those belong in a defender’s indicator set, in the advisory, not recopied here. DC.exe does DCSync: it asks a domain controller, through the replication protocol administrators use for legitimate copies, for credential material. Unexpected replication is the log line that matters.

Email theft the FBI recovered reached government organizations, law enforcement, healthcare, and religious institutions in Southeast Asia. The advisory’s audience list for the activity as a whole adds U.S. civilian government, state and local government, critical manufacturing, and information technology, in North America, Southeast Asia, and Africa.

This is not the August seizure

On August 26, 2026, the same department announced a different set of domain seizures, in the Southern District of California, against QScan and QTRouter. Those platforms belong to a group the government calls QTFY, employed by Nanjing Xinjiuwei Network Technology Company. The victim names in that release include NASA, the Federal Reserve, the Energy Department, and the Senate. The mechanism is also a pool of hacked devices, used as a proxy so the traffic does not look like it came from China. It is a different company, a different docket, and a different pair of tools. A headline that says “China-nexus botnet” fits both. The domains in this post are the October Integrity Tech list, and only that list.

A timeline the documents will support

• September 2, 2010. OFAC’s listing: Integrity Technology Group is established.
• 2017. Microscan is in use. That is the advisory’s floor. The warrant does not date the first copy.
• November 7, 2018. c0cc[.]cc is registered.
• July 23, 2021. The affidavit’s start date for this Mirai variant’s operation.
• April 26 to December 29, 2022. Microscan scans of the South Carolina power company, the NGO, the Japanese and Polish airports, and the Taiwanese gas and power companies. On August 7, inside that window, a university in Puli Township was scanned and compromised soon after.
• March 21, 2023. Hsinchu university scanned. Compromised soon after.
• June 5, 2024. Sparrow’s database: over 1.2 million device records, over 260,000 active, about 126,000 of those in the United States.
• August 12 and 19, 2024. SoftEther at the two universities calls 108.61.181[.]104 through 98aiblog[.]com.
• September 11, 2024. The FBI seizes w8510[.]com, locks the operators out of the command servers, and cuts the channel to the bots.
• September 13, 2024. The affidavit’s end date for the botnet being in use.
• September 18, 2024. The date the State Department later used for the public announcement of that disruption.
• January 3, 2025. OFAC sanctions Integrity Technology Group.
• February 18, 2025. The three lookalike domains are registered.
• July 13, 2025. Cloudflare shows x.c0cc[.]cc aimed at the Microscan server.
• February 10, 2026. 66.42.60[.]242 reaches both registrar accounts and renews the five FishHub domains with AliPay.
• March 2026. FishHub is on 207.148.92[.]220.
• June 3, 2026. The virtual-server company shows the same name aimed at the same server. The affidavit uses this record, with the July 2025 Cloudflare record, as support for who controlled the name.
• August 26, 2026. The separate QScan and QTRouter seizures.
• September 9, 2026. The Microscan login is still on x.c0cc[.]cc. 98aiblog[.]com is still on the original registrar account.
• October 6, 2026. Judge Kelly signs the warrants.
• October 8, 2026. The Justice Department announces the seizures. AA26-281A is published.

If one of these names shows up, or you run something they scanned

1. A router, camera, or recorder that has had the default password, or a firmware update waiting for a year, is the kind of device this botnet used. The September 2024 command cut one command channel. It is not a factory reset of every infected camera. Replace the default password, update the firmware from the vendor’s own site, and take the management page off the open internet. A device you cannot update is a device to replace or to unplug from the network.
2. On a network you administer, the advisory’s short list is the one worth doing first. Turn off services you do not use, especially remote administration and file sharing on the edge. Require a second factor on webmail, VPN, and anything an administrator can use. Patch the eight vulnerabilities in the table above where those products still exist in the environment, and replace anything the vendor no longer updates.
3. Look for SoftEther, or a VPN client, installed under the name conhost.exe or dllhost.exe, set to start on boot, calling a name you did not choose. Look for unexpected Active Directory replication. Look for password spraying against the Exchange and Microsoft 365 interfaces listed above, and for a process named DiagTrack.exe talking to a domain you do not recognize. A mailbox export that runs from a new application registration is the office-cli pattern.
4. The seven seized names should not resolve to your infrastructure, and your machines should not be calling them. The advisory’s indicator list is much longer than those seven, and it includes SoftEther hubs this warrant left in place. CISA publishes the indicators as STIX alongside AA26-281A. A hit on a seized name is a reason to look. A miss does not mean the rest of the indicator list is clean.
5. If you are in Canada, the Canadian Centre for Cyber Security is one of the agencies on the advisory. Reporting goes to them, and to the FBI’s IC3 at www.ic3.gov for the U.S. side of the same activity. The seizure banner points at IC3 as well.

Sources

• U.S. Department of Justice, seizure announcement, October 8, 2026.
• Affidavit of Special Agent Adam James, Magistrate No. 26-1564, Western District of Pennsylvania, sworn October 6, 2026, posted by the U.S. Attorney’s Office.
• CISA and partners, AA26-281A, October 8, 2026, and the CISA news release the same day.
• U.S. Department of the Treasury, sanctions announcement, January 3, 2025, and OFAC’s designation.
• U.S. Department of State, sanctions note, January 3, 2025, for the September 18, 2024 date of the earlier announcement.
• U.S. Department of Justice, September 2024 botnet disruption.
• U.S. Department of Justice, QScan and QTRouter seizures, August 26, 2026.