# DOJ Seizes China-Linked Hacking Domains

The Department of Justice and FBI seized seven U.S.-registered internet domains used to support cyber activity attributed to China-based Integrity Technology Group, including domains associated with the Microscan and FishHub tools linked to Flax Typhoon. The seizure was authorized by a court in the Western District of Pennsylvania and accompanied by a coordinated FBI, CISA, and NSA advisory describing threats to critical infrastructure, including vulnerability scanning, Microsoft Exchange exploitation, password spraying, and credential theft. The signals identify no solicitation, contract award, funding, or procurement contact, so this is a cybersecurity risk and market signal rather than an immediate bidding opportunity.

- Contractors supporting critical infrastructure should review the multi-agency advisory and assess exposure in internet-facing systems, VPNs, email, and operational technology environments.
- Cybersecurity providers can use the identified threat techniques to inform discussions about threat intelligence, vulnerability management, incident response, and OT security capabilities; the signals do not identify a specific procurement requirement.
- Procurement and capture teams should distinguish this federal disruption action from an acquisition: no contract opportunity or funding is announced.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 09, 2026

### Government Entities
- U.S. Department of Justice (DOJ)
- Federal Bureau of Investigation (FBI)
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Security Agency (NSA)

### Vendors
- Integrity Technology Group (China-based organization linked by U.S. authorities to the cyber activity; not identified as a procurement contractor)

### Key Quotes
> Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing.
> — Chris Butera, Acting Executive Assistant Director for Cybersecurity at CISA

### Sources
- [DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub | CyberScoop](https://cyberscoop.com/doj-fbi-seize-flax-typhoon-hacking-tools-microscan-fishhub) - CyberScoop
- [US launches cybersecurity operation to disrupt China-linked hacking network ](https://www.thenews.com.pk/latest/1419266-us-launches-cybersecurity-operation-to-disrupt-china-linked-hacking-network) - The News International
- [Prolific Chinese Hacking Group... | VitalLaw.com](https://www.vitallaw.com/news/prolific-chinese-hacking-group-disrupted-by-doj-domain-seizure/cspd01a77594b445e34fbe9246e869f677c13e) - VitalLaw.com