Seven Domain Seizures: Law Enforcement Reaches Shared Intrusion Infrastructure

01 / 18

Changing one point of contact can reach several users

On October 8, 2026, the US Department of Justice and Federal Bureau of Investigation (FBI) announced seizures affecting Integrity Technology Group’s Microscan and FishHub infrastructure. Court documents allege that actors of the China-based company operated the tools; the announcement is not a conviction.^[1]

The starting point for understanding the action is what happened to a shared point of contact. A provider develops tools and users employ them, reducing the need to rebuild the same infrastructure for each operation. If law enforcement reaches that shared component, several users' activities may be affected. Yet activities associated with the same provider need not all pass through one point. The intervention's reach depends on the actual relationships.

SG Group focuses on changing a common system outside its users. Even when a tool user is in another country, a third party managing a required point gives the intervention a specific recipient. This is a different starting point from an affected organisation updating its equipment one device at a time. How does reaching a common point change the work of providers and users? Those conditions explain its significance for international cyber activity and business costs.

02 / 18

The announcement date and the dates in the evidence

The October 6 warrant sets an October 20 execution deadline; its return is blank.^[2] A deadline differs from the date an operation occurs. Reading an announcement is easier when information specifying the instruction remains distinct in time from information describing its result.

This timing also matters when assessing effects. A business may begin checks after the announcement, while the domains' destinations change at another time. If later evidence reveals activity, its discovery date need not be its starting date. An operation continuing from before the seizure, use while changes spread, and use that has moved to a different route would support different assessments.

The affidavit includes activity in 2022, a separate 2024 intervention and investigative records in 2026.^[3] Reading these materials requires asking what each record explains. Historical evidence can support present proceedings without its scale being added to present harm. Records about continuity of activity and records about this operation serve different purposes.

03 / 18

The tool provider and the actors using its tools

The joint advisory describes Integrity Tech’s tool and infrastructure provision and cautions that labels such as Flax Typhoon need not map one for one to government tracking categories.^[4] Treating the provider and individual users as exactly the same group would overstate the intervention’s reach.

A tool service can standardise design. If one user can employ a function developed for another, the development work need not be repeated every time. The provider can also centralise the management and updating of connection points. The other side of that arrangement is dependence on a common location under the provider's control. Convenience and an accessible point of intervention may arise from the same design.

This structure does not supply an estimate of the company's revenue or user count. It shows why separating the people who build tools from those who use them changes the object of intervention. Disrupting one user's equipment may leave a common provider intact. Changing a shared point may leave users who do not require it unaffected. Reading who controls each function makes the action more concrete than treating a service name as a complete description.

AI cyber capabilities and defensive work — A different cyber case, connecting capability assessments to defensive work.

04 / 18

Target names do not measure victims

The figure groups the functions described in the court material.^[3] Its unit is a domain: a registered naming realm used to specify Internet destinations. Multiple contact points can sit beneath one realm, or different realms can connect to one function. Defining what the table counts first reduces confusion with numbers of users or victims.

Several names supporting one function need not serve identical purposes. Their use might be simultaneous, divided by task or arranged for substitution, and each arrangement would change how easy replacement is. Counting the names does not settle that question. Multiple names do not by themselves prove resilience; changing every target name does not prove that the entire function has disappeared. Its relationships with other access points determine what remains available.

Simple proportional arithmetic also fails to connect this count to economic effects. Changing a proportion of names does not imply the same proportionate reduction in harm. A name shared by many users has a different significance from one serving a limited task. The figure compares the number of targets by function, but bar lengths represent only the count of names. They do not represent a share of activity stopped or losses prevented.

05 / 18

The court's order reaches a common registration layer

Attachment A asks Verisign for reasonable measures to redirect names to FBI name servers, restrict changes and transfers pending forfeiture, and propagate DNS changes promptly.^[2] DNS, the Domain Name System, relates names to destinations. From the user’s perspective, identifying who manages that relationship helps explain the intervention.

The registration counter differs from the operator maintaining a common database. The Internet Corporation for Assigned Names and Numbers (ICANN) calls them a registrar and registry respectively.^[6] The distinction explains why intervention at converging control of names differs from reaching only the counter a registrant routinely uses.

Suppose a user changes local settings and prepares another server. If the target name cannot be associated with that new server, continuing through the old point of contact becomes harder. Resuming use of the same name requires different operations from starting again with a new name. Identifying the point law enforcement controls helps identify what must change for substitution. That describes replacement conditions, rather than predicting a period of downtime.

06 / 18

Keeping an established point or moving to another name

Combining names with infrastructure makes substitution concrete. Keeping a name while changing equipment differs from keeping equipment and adopting another name. The first depends on control over the name; the second makes communicating a new point to users significant. The figure’s four combinations are a structural example for considering that difference.

If a provider retains equipment but adopts another name, users able to receive the notice are the first people it can reach. Some may continue using the old name while others move, at least temporarily. Keeping a name while replacing equipment may require fewer changes among users. Which is easier depends on controllable components and relationships with users.

For the recipient of the order, implementation requires changing the correct targets. Including a different service with a similar name could affect unrelated users. Changing only part of what the order specifies could fail to reach its intended scope. Intervention at a common database can travel widely, making accurate correspondence between the legal target and the technical operation particularly valuable.

07 / 18

A name and a server's functions are different objects

ICANN distinguishes registering a domain from establishing a website or hosting service. A name points toward a destination; it is not the equipment running the service.^[7] A change in control over names therefore cannot establish that all programs or previously stored information have disappeared.

The distinction helps select what to measure. Asking whether connections using the old names have changed is different from asking whether the same functions remain available elsewhere. The first may change while the second remains. Conversely, code may still exist without an immediately usable point through which users can obtain the same service.

The condition of affected networks needs a further assessment. Domain seizures alone do not undo existing intrusions or recover information already taken.^[4] The principal object here is intervention at the provider's connection points. The GitLab article examines the different questions facing recipients of software already delivered.

GitLab and accounting for software already delivered — Conditions for suppliers and recipients to discuss the same delivered item.

08 / 18

Intervention at a shared point reaches users differently

Consider two users of one service. One connects to the provider's access point for each task; the other can perform some work with functions already held locally. This is a structural example. Changing the access point is more likely to affect the first user's next task directly. Its effect on the second depends on when that point is required. Sharing a provider is not enough to make the consequences identical.

In this example, A needs information about the entry point for the next task. B, while reading output already held locally, may not need the same change immediately. When B seeks new information, the question about the common point returns. Dependence differs between users and between stages of one user’s work. That prevents an effect from being allocated uniformly by headcount.

For a provider, consolidating users' connections can simplify operations, but it also creates work when a common change must reach every user. Losing an established contact point may require more than obtaining another name: the provider must align it with the people using the service. The more users' arrangements differ, the less likely one notice is to restore an identical state for everyone. Where that coordination work arises is an economic question about the shared design.

IonQ–Elisity: network permissions and cryptography — A case concerning enterprise permissions and cryptographic integration.

09 / 18

Buying another name and delivering the function again

A small registration bill does not necessarily imply a small cost of restoring the same function to users. Consider three tasks: registration, infrastructure and changes at the connecting end. Registration without infrastructure does not operate a function; infrastructure without users knowing its destination does not make it usable. The work depends on what can be carried over from the existing arrangement.

The affidavit records that, after the separate 2024 action, investigators observed a Microscan login page on September 9, 2026.^[3] That history is not evidence of a return after the present seizure. It shows why one intervention and subsequent provision of a tool must be assessed at different dates. Past continuity cannot establish how quickly the service would return this time.

Restoration of the same service differs from offering only some functions through another method. The first makes preserving relationships with existing users particularly valuable. In the second, available functions may change and users may need to change their work. A familiar name returning does not establish that the old scale or convenience has returned. A changed name, on its own, does not establish that continuity has been lost either.

10 / 18

Deciding a change and delivering it

Changes where a name is managed and destination changes seen by distant users have different observation points. Even for one point of contact, evidence that the controlling party completed work differs from evidence of a change reaching users. Relating the two makes the known extent of the change concrete.

Seeing a connection to an old destination immediately after the action would not, by itself, establish that the order had gone unimplemented. The observation's place and time, the name used and the destination reached must be read together. If the same function is used through another name, the question becomes whether a target setting was restored or infrastructure beyond the constraint was used. The parties and objects involved in further action differ between those explanations.

Reducing that interval to a judgment that the response is slow misses the underlying work. Correctly completing the specified operation and observing its effects elsewhere require different evidence. Calculating a fixed interruption period from the announcement date produces an ambiguous measure unless its start and end describe the same state. Comparing effects over time begins with identifying what changed.

11 / 18

Why reconnaissance of critical infrastructure matters economically

The Justice Department lists electricity, airports and natural-gas organisations among Microscan's reconnaissance targets. Reconnaissance is not equivalent to intrusion or an interruption of operations.^[1] These targets still have economic significance because their information systems serve functions extending beyond one organisation. Electricity and transport users cannot simply inspect the supplier's equipment and recreate the same service themselves.

When uncertainty about these industries' functions grows, businesses using their services may review their own contingencies. Where alternative supply or transport exists, its conditions can be compared. Where choices are scarce, users depend more heavily on the provider's response and explanation. Reconnaissance alone does not establish that substitution costs arose; the dependency explains how an actual disruption could reach other businesses.

Confidentiality and continued operation also need separate consideration. A problem at a point used to exchange documents differs from a problem at a point directly needed for operations, even when the same equipment is named. Information management is closer to the first assessment; continuity of service is closer to the second. Identifying the relevant function narrows the economic pathway.

Continued operations need not make an information problem small. Where a business holds non-public pricing or procurement information, its value is not measured by equipment downtime. Conversely, a company appearing among reconnaissance targets does not prove that information was taken. Considering service continuity alongside the information to protect avoids assigning losses from an industry label.

12 / 18

Shared information and each country's enforcement powers

Japan’s National Cybersecurity Office (NCO) and National Police Agency announced co-signing the US advisory on October 9, Japan time. The statement lists US, UK, Australian, Canadian, Spanish, New Zealand and Japanese partners.^[5] Reading shared information and identifying operations in each place then become different questions.

Cooperation has two aspects: reading common information and performing operations in particular places. An investigation in one country may help an organisation elsewhere reassess its access points, without giving the document power to issue the same legal order everywhere. Conversely, an order addressed to a particular operator in one country may change connections using its names across borders. The reach of information sharing differs from the reach of an order's recipient.

Common material can help countries discuss the same object. Independently produced explanations using different names or dates might treat one point as two, or merge separate activity into one. A joint document aligns the starting point for comparison. Whether its indicators fit each organisation's present environment still requires examining the specific relationship.

The number of countries signing does not guarantee an effect quantitatively. It cannot be converted into the share of activity stopped or losses reduced. The useful combination is that defenders in several regions can recognise the same points and methods, while law enforcement specifies what it actually changes. Together, those elements make intervention at shared infrastructure easier to assess in local circumstances.

13 / 18

Read business effects from where work arises

An assessment of costs can begin by separating where work falls. The recipient of the order must change registration and destinations accurately. The tool provider may need an alternative to established points. Users may have to determine whether the same functions are delivered through new ones. These tasks arise at different places from investigation costs inside an affected organisation.

Calling all three an increase in cyber costs hides who bears which burden. A provider handling migration may reduce its users' work; changes required at users' own end distribute that work. For the ordered party, implementation concerns the number of targets and the checks needed to avoid changing the wrong ones. The amounts remain unknown, but the locations of the work can still be analysed concretely.

This does not lead directly to greater demand for defensive products. Operations at a registry and products a business buys are different things. Existing systems and staff may handle some work, while other tasks require outside help. Even where spending increases, its recipient and contribution to earnings depend on the response chosen. The contracts and shareholder cash examined in the cyber-stock article begin from a different analytical question.

Cyber-defence demand and shareholder cash — Read business valuation through contracts, income and cash.

14 / 18

A country code does not locate the action's reach

IANA, the Internet Assigned Numbers Authority, records .cc as a country-code top-level domain and distinguishes its manager from the Verisign technical contact.^[8] The suffix alone cannot locate an attacker or equipment. Identifying the party an operation reaches requires reading the particular management relationships.

International services need not place users, registration counters, common databases and equipment in one country. Collapsing that arrangement into a single country label can misidentify the party an order reaches. Foreign users do not mean that operations directed at a US service provider change nothing. Reading the warrant requires connecting users' locations with the distinct question of what a specified operator must change.

The conclusion is not that one type of domain is safe and another dangerous. A suffix helps identify a registration arrangement; it does not establish an individual use. Legitimate services and abused points can share the same system. Law enforcement must identify specific targets, and users should not associate similar names indiscriminately with the same activity.

15 / 18

SG Group View: measure reach through the functions that depended on it

SG Group sees more value in linking controlled points to dependent functions than reducing the action to a single count of things stopped. Changes to specified names describe operations on those objects. Reaching users' functions requires a relationship in which users needed those points. Reaching a reduction in harm requires a further relationship.

Calling all three stages a single success or failure mixes different outcomes. Control of names may succeed while effects remain limited because some users did not depend on them. Interrupting users' work may not produce an observable change in harm over a short period. Evidence answering each question helps locate the achieved effect and the remaining task.

A decline in observed activity alone cannot isolate this action’s effect. Other responses may occur simultaneously or observation coverage may change. Comparing activity using the targets with activity not using them over the same period and method could help, although differences between the groups would remain. Records explaining what changed in the observation are more useful than a simple count before and after the announcement.

The assessment changes when evidence links the specified names to users' functions. If the same functions were widely available through other points, the constraint imposed this time would deserve less weight. If important functions were concentrated at the targeted points, the action's reach would deserve more. Neither conclusion follows from forceful language or the target count alone.

16 / 18

The objection that another name restores the service immediately

A serious objection is that registering another name restores access to the same functions. That is possible where infrastructure and user relationships are easily changed. Losing a point of contact is not losing tools or knowledge, which also supports the objection. An assessment should allow substitution rather than presume permanent cessation.

But the argument assumes that completing registration coincides with existing users regaining the same functions. Work aligning users or changing infrastructure means the registration bill does not explain the whole burden. Choosing a different point also changes how existing users reach it. Recognising an effect does not require assuming a long interruption: additional work or migration by some users can also matter.

Equally, the expectation of extra work cannot establish a large burden. Alternatives already prepared, easily adjusted user arrangements or little use of a targeted function could make it small. The present material cannot calculate restoration time or cost. Considering the objection should identify conditions that change the conclusion, rather than defend a favourable view of the operation.

17 / 18

Separate three developments by what can be observed

In the first development, control of the specified names changes and functions dependent on those points become harder to use. The name-level operation is reaching users' work. Identifying which users and functions remains necessary; one altered connection cannot describe the cessation of all activity.

In the second, control of the targets changes while the same functions are supplied through other infrastructure. An assessment differs depending on whether a target setting was restored or substitution arose outside the targets. In the latter case, fulfilment of the original order and a response to substitution are separate tasks. Observing a new name alone does not establish a return of the same users, functions or scale.

In the third, the change in contact points is known but material about functional use is insufficient. A change in law enforcement's objects can be demonstrated without deciding the magnitude of its operational effects. Locating the unresolved question avoids dismissing the confirmed operation or extending it into reduced losses. The figure presents these branches without probabilities or rankings.

18 / 18

Where subsequent evidence would change the assessment

Further court material would bear on execution and the stage of forfeiture proceedings. An execution deadline does not promise a future results announcement or court hearing. A record of operations performed could be compared with the commands issued. Progress in the treatment of rights would change the meaning of restrictions over the target names.

Updates about activity matter when they connect names, functions and users. A name appearing again is insufficient on its own; the function and date to which it relates are useful. The joint advisory's indicators include observations since January 2016, so historical records must remain distinct from current use.^[4] A matching indicator can justify further inquiry without proving, at the same time, that a present service needs that point.

Shared contact points help extend a service and give a third party a place to intervene. The value of reading this action is seeing both sides concretely: what was changed, which functions needed it, and what changes when another infrastructure is used. Connecting subsequent material to those relationships permits reassessment of effects and limits without relying on target counts or forceful statements.