Federal authorities have seized seven internet domains and other infrastructure used by two intrusion tools that the government attributes to operators associated with a Chinese technology company.
The Justice Department said Thursday that court orders issued in the Western District of Pennsylvania disabled access to “Microscan” and “FishHub.” According to unsealed affidavits, the tools were used to scan networks, deliver spear-phishing material and, in some instances, steal files from critical-infrastructure and other systems in the United States and abroad.
The filings link the operation to Integrity Technology Group, a company that has contracts with the Chinese government and has previously been associated by US authorities with the group commonly called Flax Typhoon. Those links are government allegations contained in warrant materials, not findings from an adversarial trial.
The action is a disruption measure rather than a criminal conviction. By redirecting or taking control of the domains, investigators sought to cut operators off from systems used to manage malicious activity. The affidavits also describe forensic work used to identify servers and domain names connected to the tools.
Review the Justice Department filing materials
