US and Microsoft disrupt global cybercrime infrastructure

The US Department of Justice and FBI, in coordination with the Japanese National Police Agency, have taken significant actions to dismantle cyberattack infrastructures operated by Chinese-linked entities.

Authorities seized domains associated with Integrity Technology Group, a firm accused of developing and using tools such as ‘Microscan’ and ‘FishHub’. Microscan was reportedly used to scout vulnerabilities in critical infrastructure, including airports in Japan and Poland, and utility companies in Taiwan. FishHub was utilized for spear-phishing and facilitating unauthorized remote access. This follows a previous disruption of the company’s Mirai-based botnet in September 2024.

In a separate but related effort, Microsoft announced the disruption of a massive cybercrime ecosystem targeting over 75,000 organizations across 150 countries. Working with the Japanese National Police Agency and other international partners, Microsoft disabled more than 20,000 accounts and blocked 100,000 domains linked to the ‘YAM Store’ underground market and various phishing kits like ‘Iron Man System’. These tools were used to distribute over one billion malicious messages, impersonating banks, healthcare providers, and government agencies.