Patch WordPress, Jenkins, OpenSSL to block China-linked botnet after US seizure
US authorities seized hacking tools linked to China’s Integrity Tech, which scanned critical infrastructure using a massive botnet of infected IoT devices.
Key points
- DOJ and FBI seized Microscan and FishHub tools operated by Integrity Technology Group.
- The botnet contained over 1.2 million infected devices, with 385,000 in the US.
- Microscan used penetration scripts to target weaknesses in WordPress, Jenkins and OpenSSL.
US authorities have seized two cyber espionage tools, Microscan and FishHub, that were used to scan and breach critical infrastructure systems globally. The Justice Department and FBI announced the court-authorized seizures this week, denying malicious actors access to these platforms. The tools were built and operated by Integrity Technology Group, a Beijing-based company that holds direct contracts with the Chinese government.
Which organisation operated these seized tools?
The tools were operated by Integrity Technology Group, a firm based in the People’s Republic of China. Researchers have linked the company to a hacking group known by several aliases, including Flax Typhoon, Ethereal Panda and RedJuliett. Assistant US Attorney Troy Rivetti described this operation as the Department’s second disruption of Integrity Tech’s activities in as many years. This indicates that previous takedowns did not permanently halt the group’s operations.
What did the seized tools do?
Microscan and FishHub were used to scan networks and, in some cases, break into them. Microscan, accessed via the domain c0cc.cc, ran more than 1,300 penetration testing scripts. These scripts targeted known weaknesses in software such as OpenSSL, WordPress, Jenkins and Apache Struts. According to FBI affidavits, the tool had been in active use since at least 2017 and remained reachable through its domain as recently as September 9 this year.
How large was the supporting botnet?
Integrity Tech built and ran a botnet composed of infected Internet of Things devices running a version of Mirai malware. Court documents reviewed by The Hacker News show the botnet database held records for more than 1.2 million infected devices in June 2024. Of these, more than 385,000 were located in the United States. At that time, around 260,000 devices were actively infected, including approximately 126,000 in the US.
What does this mean for infrastructure security?
The seizure demonstrates that critical infrastructure across multiple countries was subjected to scanning and potential breaches. The tools allowed actors to identify and exploit vulnerabilities in widely used software platforms. While the specific tools are now seized, the underlying vulnerabilities in software like Apache Struts and WordPress remain relevant. Organisations must assume that similar tools may exist or be rebuilt by the same actors.
Background: IoT device vulnerabilities
IoT attacks progress from physical access or network reconnaissance to exploiting firmware flaws or weak credentials. Attackers then install persistent backdoors. You can interrupt this chain by disabling unused ports, enforcing strong authentication, and verifying firmware signatures before installation.
Read the full guide: IoT Vulnerability Lifecycle: From Physical Access to Data Theft
What to do and how to stay safe: Microscan
- Audit your network for unauthorised IoT devices that may be running outdated firmware or Mirai variants.
- Verify that all instances of WordPress, Jenkins, Apache Struts and OpenSSL are updated to the latest stable versions.
- Monitor network logs for unusual scanning activity or connections to suspicious domains similar to c0cc.cc.
- Review firewall rules to ensure that external access to administrative interfaces is restricted to trusted IP addresses.
Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What companies are linked to the Microscan tool?
The tool is linked to Integrity Technology Group, a Beijing-based company with government contracts, also known as Flax Typhoon.
How many US devices were in the botnet?
In June 2024, more than 385,000 infected devices were located in the US, with about 126,000 actively infected.
Did the US stop Integrity Tech permanently?
No, this was the second disruption of the group’s operations in two years, suggesting they continue their activities.
