The Justice Department and FBI’s October 8 seizure of domains associated with two China-linked hacking tools is important. It is not, however, important only because investigators disrupted infrastructure attributed to Integrity Technology Group, a Chinese company that the government says has contracts with the Chinese government.
The more consequential technology story is the way the operation was assembled.
According to the Justice Department’s announcement and the FBI affidavit supporting the seizure warrants, the operation combined a botnet of infected internet-connected devices, command-and-control servers, automated vulnerability scanning, phishing infrastructure, malware delivery and remote-access tools.
That is not one piece of malware performing one task. It is a chain of specialized systems, each doing part of the work required to find, enter and exploit a network.
The machine behind the seizure
The first component was a variant of Mirai malware targeting internet-connected devices such as routers, cameras, digital video recorders and network-attached storage systems. The FBI affidavit says a database associated with the botnet contained records for more than 1.2 million infected devices as of June 5, 2024, including more than 385,000 devices in the United States. Approximately 260,000 devices, including about 126,000 in the United States, were listed as actively infected at that time.
Those devices did not need to contain valuable data to be useful. Their network locations were valuable. A compromised router or camera could provide an address from which to send traffic, a relay point for commands or a way to make an overseas operation appear to originate from a device in the United States.
The botnet therefore served two purposes. It supplied scale, and it complicated attribution.
The next component was Microscan, a vulnerability-scanning tool that the affidavit says was used to conduct reconnaissance of victim networks. The tool could search for weaknesses across multiple targets, sometimes using the Mirai botnet to obscure the origin of the scans.
Scanning is not the same as compromise. A scan can identify a possible opening without proving that anyone entered through it. But it is not harmless background noise either. Reconnaissance is the stage at which an attacker determines where effort is likely to produce access.
The third component was FishHub, which the FBI says facilitated phishing activity and the delivery of additional malicious code. According to the affidavit, code associated with FishHub could create file listings, search for specific files, compress documents and send selected material to an attacker-controlled server. In some cases, the operation used SoftEther, a legitimate remote-administration tool, to maintain access after an initial compromise.
Put together, the sequence looked something like this:
infected device → command server → automated scan → phishing or exploit → remote access → file search and exfiltration
The domains seized by federal authorities were visible points in that chain. They were not the whole chain.
What investigators say they found
The government says Microscan scanning reached a South Carolina power company, a multinational nongovernmental organization, Japanese and Polish airports, Taiwanese natural-gas and power companies, and two Taiwanese universities. The affidavit describes successful intrusions at the two Taiwanese universities after they had been scanned.
The Justice Department also says FishHub activity affected approximately 20 Taiwanese universities. The FBI affidavit describes more than 20 entities whose data or files appeared on a server associated with FishHub, including at least six Taiwanese universities.
Those findings are serious, but the public record still has limits. It does not establish that every organization scanned by Microscan was successfully compromised. It does not establish that every infected U.S. device was used in an attack, or that the South Carolina power company experienced operational disruption or data theft.
The affidavit is a probable-cause document supporting seizure warrants. It is not a complete map of the operation, and it does not claim to contain everything investigators know.
That distinction matters because cyber investigations often produce a misleading visual impression. A list of scanned organizations can look like a list of victims. Technically, those are different categories. A scanned system may have been rejected by the attacker, protected by a control the attacker could not bypass or simply left for later.
Why ordinary devices matter
The infected devices in this case were not necessarily the intended victims. They were infrastructure.
That is an important change in how many people understand a botnet. The object being controlled may be a household router, a business camera or an old digital video recorder. Its contents may be uninteresting. What matters is its connection to the wider network.
A device can be useful because it offers:
- an internet address from which to send traffic;
- a relay point that makes an operation harder to trace;
- a platform for distributing commands or malware;
- a source of scanning capacity; or
- a position close to another target.
This is why consumer and small-business equipment belongs in the security conversation even when it does not store sensitive corporate files. A device does not have to be valuable as a computer to be valuable as someone else’s equipment.
The limits of a domain seizure
Domain seizures can be useful. They can interrupt access to tools, redirect traffic, expose infrastructure and help investigators notify or identify victims. The Justice Department says this action was the second public technical disruption involving Integrity Technology Group; in September 2024, federal authorities disrupted an earlier Mirai botnet associated with the company.
But disruption is not eradication.
Seizing a domain does not clean an infected router. It does not repair the vulnerability that allowed a camera or DVR to be compromised. It does not rotate a credential that may already have been stolen, restore confidence in a system that may have been altered or prevent an operator from replacing infrastructure elsewhere.
The joint FBI and partner cybersecurity advisory provides indicators of compromise for defenders. That is useful, but indicators are most valuable when organizations have retained enough DNS, firewall, endpoint, identity and network-flow data to use them.
Many organizations discover after an incident that they can block a suspicious address but cannot answer more basic questions: Was the connection successful? Which account was involved? What files were accessed? Did the same device communicate with another system? Was the traffic generated by a compromised vendor, an employee device or an unmanaged appliance?
Defenders see fragments
The attack pipeline crossed several administrative boundaries: consumer devices, virtual private servers, domain registrars, hosting companies, phishing systems and enterprise networks.
A utility may see reconnaissance. A university may see a phishing message. A hosting provider may see unusual server activity. A registrar may see a cluster of newly created domains. A device owner may see nothing at all.
Each organization may possess one fragment of the event. The complete pattern becomes visible only when those fragments are connected.
That creates a practical problem for defenders. Security teams are often responsible for protecting the systems they operate, but attackers are free to use systems they do not own. The boundary of the attack is therefore wider than the boundary of the organization.
This is also why the distinction between a vulnerability and an intrusion matters. Patching a target may prevent the next attempt, but it does not answer whether the system was searched already. Blocking a domain may interrupt delivery, but it does not prove that a downloaded file was never executed. Removing a server may disrupt command and control, but it does not tell a victim whether the attacker copied anything before the connection disappeared.
The question after the seizure
The useful question for U.S. organizations is not simply whether the FBI has taken control of the identified domains. It is whether defenders can recognize and disrupt the sequence before reconnaissance becomes access, and access becomes persistence or theft.
That requires more than a list of suspicious addresses. It requires inventories of internet-facing systems and connected devices, visibility into vendor and remote-administration access, retained logs, procedures for investigating scanning and tested recovery plans.
It also requires a realistic understanding of what a compromised device means. A router, camera or DVR that has become part of a botnet may be an early warning about someone else’s operation, not merely a local equipment problem.
The Justice Department’s action has interrupted identified infrastructure. That is valuable. It may help network operators find activity they otherwise would have missed. But the lasting lesson is less comfortable: modern cyberattacks can be assembled from ordinary internet services and inexpensive connected devices, with reconnaissance, access and theft separated across different tools and organizations.
The FBI seized several tools. The larger problem is the pipeline that allowed those tools to work together—and the fact that many defenders may still see only one part of it.
