Washington: The US Justice Department and FBI have seized internet domains used by suspected Chinese state-sponsored hackers to target critical infrastructure and other computer networks in the United States and abroad, disrupting two tools used for vulnerability scanning and targeted cyberattacks.
The operation targeted Microscan and FishHub, tools allegedly operated by hackers working for Integrity Technology Group, a China-based company with contracts with the Chinese government.
The Justice Department announced Thursday that the seizures were authorised by a federal court in Pennsylvania and were intended to prevent the hackers from continuing to use the infrastructure.
The tools were associated with Flax Typhoon, a Chinese state-sponsored cyber group that US authorities have linked to attacks on government, commercial and critical infrastructure networks.
“The United States will not allow China or its proxies to operate against United States interests with impunity in cyberspace,” said Assistant Attorney General for National Security John A. Eisenberg.
He said the Justice Department would continue using its investigative and enforcement powers to disrupt the group’s operations and protect critical networks.
According to court documents, Integrity Tech developed Microscan to identify vulnerabilities in computer systems that could subsequently be exploited by its clients.
The company allegedly used a botnet consisting of internet-connected devices infected with a variant of Mirai malware to conduct large-scale scanning operations.
Targets included a power company in South Carolina, a multinational non-governmental organisation, airports in Japan and Poland, Taiwanese natural gas and electricity companies, and two universities in Taiwan.
Investigators said the hackers accessed Microscan through one of the seized internet domains.
The second tool, FishHub, was allegedly used in spear-phishing attacks designed to compromise targeted computer networks.
Once hackers gained initial access, FishHub could download additional malicious software that allowed unauthorised remote access or searched for specific files and transmitted them to servers controlled by Integrity Tech.
The Justice Department said approximately 20 Taiwanese universities were confirmed victims of FishHub-related activity.
The FBI seized domains associated with both tools to prevent their continued use in malicious operations.
A seizure warrant issued on October 6 by US Magistrate Judge Maureen P. Kelly in the Western District of Pennsylvania authorised the seizure of seven domain names.
US Attorney Troy Rivetti for the Western District of Pennsylvania said the operation demonstrated Washington’s determination to disrupt Chinese-linked cyber operations.
“These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims’ vulnerabilities,” Rivetti said.
FBI Cyber Division Assistant Director Brett Leatherman said the Chinese government relied on contractors and supporting companies to expand the reach of its cyber operations.
“The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” Leatherman said.
The operation marks the second publicly announced US disruption of Integrity Tech’s cyber infrastructure.
In September 2024, the Justice Department announced the disruption of a Mirai malware botnet associated with the company that involved more than 200,000 consumer devices in the United States and other countries.
(IANS)
