US authorities announced the disruption of MicroScan and FishHub, two tools attributed to Integrity Technology Group and used by Chinese state-sponsored actors against critical infrastructure. The operation seized domains the tools used for access and control.
According to a joint advisory cited by SecurityWeek, MicroScan is a Python-based web application with more than 1,300 penetration-testing scripts and has been active since at least 2017. FishHub has been used for spear-phishing-enabled network access, remote file searches and data exfiltration. Reported targets include critical infrastructure, airports, universities and government-related organizations.
Defenders should treat the disruption as a reason to validate exposure rather than as a complete fix. Review logs for reconnaissance and credential attacks, prioritize patching of internet-facing services, restrict administrative access and monitor for the listed infrastructure and known tradecraft in the government advisory.