Federal prosecutors didn't just issue another stern warning last week. They grabbed the keys. By seizing seven domains tied to Beijing-based Integrity Technology Group, the US Department of Justice and the FBI struck directly at infrastructure used to probe critical infrastructure networks worldwide.
If you've been watching state-sponsored cyber operations for a while, you know that takedowns are often symbolic. But seizing domain names stops automated scanning in its tracks. It forces malicious actors to scramble, burn old code, and rebuild their command-and-control pipelines from scratch. Don't miss our earlier post on this related article.
Let's look at what actually happened, why this specific takedown matters, and what network defenders need to do right now.
Inside the Integrity Tech Takedown
The recent DOJ action focuses heavily on tools like Microscan, a scanning apparatus linked directly to Integrity Technology Group. According to unsealed FBI affidavits, this tooling wasn't just sitting idle. Investigators tracked scanning activity targeting a South Carolina power company, international airports in Japan and Poland, a multinational nonprofit organization, and Taiwanese companies embedded in natural gas and electricity supply chains. To read more about the context here, Gizmodo provides an informative breakdown.
Court filings draw a sharp line between scanning and full-scale breaches. While investigators noted that two Taiwanese universities suffered actual compromises after initial scans, many other targeted entities only experienced reconnaissance probes. Still, reconnaissance is the prelude. You don't map out a power plant's perimeter unless you're planning an eventual entry.
This operation represents the second public US disruption targeting Integrity Tech-linked infrastructure in two years. Back in September 2024, federal authorities dismantled a massive botnet of over 200,000 compromised home routers and IoT cameras. Yet, despite that blow, tools associated with the contractor persisted. That resilience explains why domain seizures remain necessary. Cyber espionage infrastructure is hydra-headed; cut off one URL, and operators try to spin up another.
Why Private Contractors Are Doing State Heavy Lifting
State-sponsored cyber espionage has evolved. Years ago, intelligence agencies relied purely on internal military units. Today, governments routinely outsource the dirty work to commercial front companies and private contractors.
Integrity Tech serves as a prime example of this commercialization model. Sanctioned previously by the US Treasury Department in January 2025 and targeted by the UK's National Cyber Security Centre in December 2025, the firm has repeatedly denied wrongdoing. Beijing's foreign ministry has similarly rejected the accusations, framing them as politically motivated misinformation and calling out Western double standards.
Contractors give state actors plausible deniability. If a private tech firm gets caught running mass vulnerability scans or deploying botnets, official state spokespersons can shrug and claim it is just routine commercial software development gone rogue.
Security researchers note that these groups blend automated mass scanning with manual exploitation. They don't just write scripts and walk away. Human operators step in once a soft spot is found, extracting sensitive emails, credentials, and configuration files before anyone notices the intrusion.
The International Pushback
What makes this particular enforcement wave notable is the coordination behind it. Western intelligence agencies are no longer operating in silos. Joint advisories involving multiple countries highlight a shared realization: critical infrastructure is perpetually exposed.
The UK's NCSC recently joined international partners in warning that these groups are blending automated reconnaissance with massive botnet infrastructure. When seven different nations sign onto a single cybersecurity advisory about one specific Chinese contractor, it signals a shift in diplomatic posture. Governments are tired of playing defense after the fact. They are actively naming names, disrupting domains, and offering multi-million-dollar rewards for individuals tied to state-sponsored hacking syndicates.
What Network Defenders Must Do Right Now
If you manage corporate networks, critical infrastructure, or government IT systems, waiting for a government seizure isn't a strategy. The indicators of compromise are out there.
You need to act immediately:
- Audit external exposures: Run deep scans on your perimeter devices. Look for unpatched firewalls, exposed remote management ports, and outdated VPN appliances.
- Review account protections: Implement phishing-resistant multi-factor authentication across every single administrative account. Stolen credentials remain the easiest key to the kingdom.
- Hunt for anomalous traffic: Check your logs for unexpected automated scanning patterns, unusual outbound data transfers, and anomalous script executions.
- Patch known vulnerabilities: Stop prioritizing patches based on convenience. If an advisory drops for a zero-day or an exploited-in-the-wild flaw, patch it within hours, not weeks.
The digital battlefield is shifting from passive observation to active infrastructure disruption. Domain seizures won't solve the geopolitical tension driving these campaigns, but they buy defenders precious time to lock down their systems before the next wave hits.
