The US Justice Department and FBI announced on October 8 that they had seized seven domain names used to operate two alleged Chinese cyber espionage tools targeting critical infrastructure and other networks in the United States, Asia and Europe.

The court-authorized operation targeted Microscan, a vulnerability-scanning tool, and FishHub, a spear-phishing platform. US authorities allege that actors working for China-based Integrity Technology Group used the services to identify vulnerable systems, deliver malicious messages and, in some cases, compromise targeted networks.

Seven domains were identified for seizure. The unsealed court affidavit identifies seven domains associated with the operation, although the Justice Department’s public announcement names only six. The seizures were intended to disrupt the Internet infrastructure supporting the two tools rather than merely identify the individuals allegedly operating them.

The operation targeted two stages of cyber intrusion. According to US authorities, Microscan enabled operators to scan networks for potentially exploitable weaknesses, while FishHub supported spear-phishing campaigns designed to deceive selected recipients. Together, the capabilities could help attackers move from identifying exposed systems to obtaining unauthorized access.

The government’s allegations extend to networks supporting critical infrastructure, including power and transportation systems. The reported targeting also reaches beyond the United States, with alleged activity involving networks in Asia and Europe. The extent of successful compromises and the identities of affected organizations have not been independently established.

Domain seizures disrupt malicious infrastructure at the DNS level. By redirecting or disabling domain resolution, authorities can sever access to services that depend on the seized names, including vulnerability-scanning and phishing platforms. The operational impact depends on how extensively those services rely on the affected domains and whether alternative access mechanisms exist.

Domain seizures do not, however, necessarily disable the underlying servers or eliminate the operators’ capabilities. Unless supporting infrastructure is also compromised or dismantled, operators may be able to restore services through replacement domains, modified DNS configurations or alternative hosting arrangements.

US authorities also issued new defensive guidance. An October 8 FBI advisory provides additional information intended to help network defenders identify and respond to the alleged activity. The advisory accompanies the domain seizures as part of the government’s effort to disrupt the operation and support detection of related threats.

The Justice Department did not specify the precise time of the seizures. The action was publicly reported by the Associated Press at 18:12 UTC on October 8.

The court filing documents the legal basis for the seizures, while the attribution to Integrity Technology Group and the allegations concerning targeted and compromised networks remain government claims. Whether the domain seizures have permanently disabled either tool, or merely interrupted their operation, has not been independently established.