[GAME THEORY] The exploit is only one part of the business

On October 8, a joint government advisory described how China-linked operators enabled by Integrity Technology Group combine scanning, exploitation, password attacks, VPN persistence, and email theft. The same day, the US Justice Department announced seizures targeting the company's Microscan and FishHub tools. This is not simply another list of software to patch. It is a view into the business of supplying capabilities that help intrusions reach useful data. [1, 2]

AlphaHunt's judgment: fund exposure reduction, high-value identity controls, and collection containment as one operating capability. Keep urgent patching inside it. A closed exploit route is a real defensive gain; it is not evidence that the remaining routes are closed.

The new decision is about coverage across that capability mix—not proof that every operator can switch routes at will, or that every China-linked intrusion belongs to one platform.

The fast scan: access is the input; collection is the product

• Observed: The advisory connects reconnaissance and known-vulnerability exploitation with Exchange password attacks, SoftEther VPN persistence, directory credential theft, and automated mailbox collection. These are disclosed capabilities, not one proven sequence in every victim. [1]
• Judgment: A provider that supplies tools and infrastructure can lower the effort required for operators to try another route. That makes isolated remediation an incomplete management model.
• Uncertainty: Public reporting does not quantify substitution costs, customer relationships, or how often operators successfully change routes after a patch.
• Next move: Pair the remediation owner with the identity and mail owners. Ask what can still reach the same data after the named exploit is blocked.

The supplier has options your dashboard may not count

DOJ alleges that Microscan performed reconnaissance of networks for vulnerabilities clients would later exploit. FishHub allegedly supported spearphishing and follow-on malware that supplied remote access or collected files. That division of work makes the enablement argument more concrete than an actor label alone. These remain government allegations, not adjudicated findings. [2]

There is continuity, too. DOJ's September 2024 disruption described a botnet of more than 200,000 consumer devices and a customer-facing KRLab application for controlling infected devices. The October action does not prove that disrupted infrastructure survived unchanged; it shows the same company named in another capability-focused intervention. [3]

A patch dashboard can close a ticket. The attacker does not have to close the account.

For the engineer who spent the maintenance window fixing the exposed application, this is not an argument that the work was wasted. It is an argument against making that engineer responsible for authentication and mailbox authority they do not own.

One clean win: Pick one recently remediated public service. Verify its owner, its business reason for being public, its authentication exceptions, and whether a foothold can still reach mail or directory services. Leave with one named residual route and one accountable owner—not another inventory nobody can change.

Below the tear: how to turn that check into a six-month investment decision, with bounded tests and measures that do not mistake a smaller patch queue for a smaller intrusion opportunity.

Budget against routes to collection, not tool names

The useful game-theory question is which attacker choices your next investment makes unavailable, expensive, or easier to interrupt. You do not need a numerical attacker-profit estimate to ask it.