The Hackers-for-Hire Scanning Your Network Are Using Bugs From 2014

On Thursday, October 8, the Justice Department and FBI announced a court-authorized seizure of internet domains tied to two hacking tools, MicroScan and FishHub. The U.S. says both were operated by Integrity Technology Group, a China-based company with contracts with the Chinese government. Cybersecurity agencies in the U.S., U.K., Australia, Canada, Japan, New Zealand and Spain published a joint advisory the same day.

Most of the coverage focused on the geopolitics. I want to focus on two details that matter more to your board.

A Company Whose Business Is Finding Your Weak Spots

First, this was not a rogue hacker. The advisory describes Integrity Technology Group as a for-profit enabler: a company that builds and sells cyber tools to others. The FBI's Cyber Division said the company gave China-linked actors capabilities for widespread vulnerability scanning and, in some cases, intrusions. The U.K.'s National Cyber Security Centre said the group combines AI-powered scanning, large botnets and manual exploitation.

Think of it as a commercial service. MicroScan, a Python-based scanner with more than 1,300 penetration-testing scripts, was reportedly in use since 2017 and still reachable as recently as September 9. It works through a network of hijacked internet-connected devices, so the scanning does not come from one suspicious address you could simply block. FishHub handled the next step: phishing emails and malware that gave attackers remote access and the ability to pull files out.

A U.S. power company in South Carolina was among the organizations MicroScan scanned. Airports in Japan and Poland, Taiwanese gas and power companies, and a multinational nonprofit were also named. Reporting is careful on one point, and so should we be: being scanned is not the same as being breached, and the FBI has not said those named were compromised. FishHub's confirmed victims were Taiwanese universities.

The pattern is the point. If you operate anything connected to the internet, an industrialized scanning service is probably already looking at it.

The Bugs Aren't New. That's the Problem.

Second, look at what the tools were looking for. According to BleepingComputer's reading of the advisory, the actors targeted eight known vulnerabilities. The list includes Shellshock, a flaw from 2014. It includes a 2015 flaw in ProFTPD, a file-transfer server, and a 2016 flaw in Apache Struts, the web framework behind the 2017 Equifax breach. The newest on the list dates to 2023.

Five of those flaws were reportedly added to CISA's Known Exploited Vulnerabilities catalog, with a federal deadline of October 11, today. Federal agencies must fix them or stop using the software. You almost certainly have no such deadline.

That is the compliance-versus-security gap in one sentence. In Cyber Risk Is Business Risk, I argue that a mandate tells you the floor, not whether your company is safe. A deadline that binds federal agencies does nothing for a manufacturer, hospital or utility that has no obligation to read the KEV catalog at all. The attackers do not care which of you has a deadline. They run the scripts against everyone.

Nobody chooses to run a nine-year-old vulnerable server. It happens because no one knows it is there: an old file server a vendor set up, a content system a marketing team spun up, a test environment that became production. You cannot patch what you cannot name.

The Three Questions, Applied

The framework in my book asks three questions about any material risk.

What can go wrong? Attackers with commercial-grade scanning find a forgotten, internet-facing system running software with a public, years-old exploit. They get in quietly, and from there can move toward your real systems or your email.

What are we doing about it? Many leaders answer with the patch program. But patch programs cover the assets someone has listed. The real exposure is the unlisted ones.

How do we know it's working? This is where most boards get a slide of green dashboards. A better measure is the number of internet-facing systems found by an outside scan that were missing from your own inventory. If that number is not zero, and falling, the program is not working, whatever the dashboard says.

What to Ask Your CISO This Week

• Can you give me the list of everything we expose to the internet, and when was it last checked by someone outside our team? If the answer is a spreadsheet maintained by hand, ask how often it is reconciled against an actual scan.
• Do we run any software that is more than five years old and reachable from outside? If so, who owns it, and what is the plan to retire it?
• Do we track the CISA Known Exploited Vulnerabilities catalog, and how fast do we close what is on it? Ask for the number of days, not a yes or no. Federal agencies get days to weeks. Ask how we compare.
• Which of our edge devices and servers generate logs someone actually reads? Attackers in this campaign favored internet-facing equipment with limited monitoring and legitimate built-in tools that blend in with normal activity.
• Who would we call if a government agency told us we were a scanning target? Make sure any outside warning reaches someone who can act on it.

The Bottom Line

The Justice Department has now disrupted this company's operations twice in two years. A 2024 action took down a botnet of more than 200,000 compromised consumer devices, and the U.S. sanctioned the company in January 2025. Yet the tools were back, and the vulnerabilities they target are still there. Seizing domains slows an adversary. It does not fix your servers.

The most useful thing a board can do this month is ask a simple question, and refuse to accept a vague answer: what do we have exposed, and how do we know?