The US Justice Department and the Federal Bureau of Investigation (FBI) have seized internet domains allegedly used by Chinese state-sponsored hackers to target critical infrastructure and computer networks in the United States and other countries, disrupting two tools linked to suspected cyberattacks.
The operation targeted Microscan and FishHub, tools allegedly operated by hackers working for China-based Integrity Technology Group, a company that has contracts with the Chinese government.
Announcing the action on Thursday, the Justice Department said the domain seizures were authorised by a federal court in Pennsylvania to prevent the infrastructure from being used for further malicious cyber activity.
US authorities have linked the tools to Flax Typhoon, a Chinese state-sponsored cyber group accused of targeting government, commercial and critical infrastructure networks.
“The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace,” Assistant Attorney General for National Security John A. Eisenberg said, adding that the department would continue using its investigative and enforcement powers to disrupt the group’s operations and protect critical networks.
According to court documents, Integrity Technology developed Microscan to identify vulnerabilities in computer systems that could subsequently be exploited. Investigators alleged that the company used a botnet of internet-connected devices infected with a variant of Mirai malware to conduct large-scale scanning operations.
Targets reportedly included a power company in South Carolina, a multinational non-governmental organisation, airports in Japan and Poland, Taiwanese natural gas and electricity companies, and two universities in Taiwan. Investigators said the hackers accessed Microscan through one of the seized domains.
FishHub, the second tool targeted in the operation, was allegedly used in spear-phishing campaigns designed to compromise specific computer networks. After gaining initial access, hackers could use it to install additional malicious software, obtain unauthorised remote access, search for targeted files and transmit them to servers controlled by Integrity Technology.
The Justice Department said approximately 20 Taiwanese universities had been confirmed as victims of FishHub-related activity.
A seizure warrant issued on October 6 by US Magistrate Judge Maureen P. Kelly in the Western District of Pennsylvania authorised the seizure of seven domain names.
US Attorney Troy Rivetti said the operation demonstrated Washington’s determination to disrupt cyber operations linked to China. FBI Cyber Division Assistant Director Brett Leatherman alleged that the Chinese government relied on contractors and supporting companies to expand the scale of its cyber activities.
The operation is the second publicly announced US disruption of cyber infrastructure associated with Integrity Technology. In September 2024, the Justice Department announced the disruption of a Mirai malware botnet linked to the company that involved more than 200,000 consumer devices in the United States and other countries.
FOLLOW NOW
