Your daily dose of news, covering the latest updates in politics, business, sports, entertainment, and more from India and around the world.
By Chetanya Sarraf
Oct 12, 2026, 5:30 PM
US Seizes Seven Domains in China-Linked Hacking Probe
The United States Department of Justice and the Federal Bureau of Investigation (FBI) have taken action against a network of internet domains allegedly used to support cyber operations linked to China. The operation, announced on October 8, involved the seizure of seven domains connected to tools investigators say were used to identify weaknesses in computer systems and gain unauthorised access to networks.
According to US authorities, the tools were associated with cyber actors working with Integrity Technology Group, a China-based company with contracts with the Chinese government. Investigators allege that the infrastructure supported activities targeting critical infrastructure and other organisations in the United States and overseas.
The action aims to prevent the continued use of the identified domains for malicious cyber activity. It also highlights the importance of cybersecurity as governments and organisations face threats involving data theft, network intrusion and software vulnerabilities.
US Officials Move Against Domains Tied to Cyber Operations
The operation focused on seven internet domains that authorities said helped provide access to tools used in alleged hacking activities. The Justice Department stated that the domains were seized under court authorisation to disrupt the infrastructure supporting the operations.
Investigators linked the activity to a group commonly known in the cybersecurity industry as Flax Typhoon. US officials have associated the group with Integrity Technology Group and alleged that its tools supported attempts to examine computer networks for security weaknesses.
The operation focused on online infrastructure that allegedly helped make the activity possible. Disrupting domains and related services can prevent operators from accessing tools through those addresses and make it harder to continue using the same systems.
The action forms part of a broader campaign by US law enforcement to combat cyberattacks targeting government services, private companies and other organisations. Critical infrastructure is a particular concern because disruptions to essential systems can have consequences beyond the organisations directly affected.
How the Alleged Hacking Tools Worked
According to the US Justice Department, two tools connected to the operation were known as Microscan and FishHub. Investigators alleged that they supported different stages of cyber activity, from identifying potential weaknesses to facilitating unauthorised access and information collection.
Microscan was reportedly used to examine computer networks for vulnerabilities. Such scanning can identify systems exposed because of outdated software or configuration problems. While vulnerability scanning is legitimate when authorised, its use to prepare unauthorised intrusions creates serious risks.
FishHub was allegedly used in activities involving spear phishing. This technique involves deceptive messages designed to persuade selected recipients to open harmful attachments, visit fraudulent websites or disclose sensitive information.
According to court documents described by the Justice Department, the tool could help deliver malicious software after an initial compromise. That software allegedly enabled remote access to affected networks or helped locate files for transfer to systems controlled by the operators.
Officials said the suspected cyber activity had impacted organisations across multiple countries. The targets identified in the Justice Department’s announcement included a US power company, airports in Japan and Poland, Taiwanese infrastructure organisations and universities.
The reported targets demonstrate why cybersecurity incidents can have international consequences. A weakness in one network may provide an entry point for further activity if appropriate safeguards are not in place.
Critical Infrastructure and the Wider Cybersecurity Challenge
The operation has renewed attention on the security of essential services and the networks supporting them. Power systems, transport facilities, universities, businesses and public institutions rely on digital infrastructure for communication and everyday operations.
A successful intrusion can expose confidential information, interrupt services or provide attackers with access for further activity. Even without an immediate disruption, unauthorised access can create longer-term risks if attackers remain inside a network.
Cybersecurity experts encourage organisations to update software, review access permissions, monitor unusual network activity and use strong authentication measures. Organisations should also educate staff on spotting phishing attempts and confirming unexpected requests for passwords or other confidential data before responding.
The US government said the domain seizures were accompanied by a cybersecurity advisory prepared with domestic and international partners. Such advisories can help network defenders recognise indicators of malicious activity and investigate possible exposure.
The latest action also follows an earlier US operation against infrastructure linked to Integrity Technology Group. In September 2024, authorities announced the disruption of a botnet involving more than 200,000 internet-connected devices, according to the Justice Department.
A botnet consists of infected devices that an attacker can control remotely to carry out malicious activities. Routers and cameras may become part of such networks when they are not adequately secured, often without their owners knowing.
The previous disruption and the latest domain seizures illustrate how authorities may target different parts of cyber infrastructure. However, continued monitoring remains necessary because malicious operators may attempt to rebuild their systems or find alternative ways to reach vulnerable networks.
What the Seizure Means Going Forward
By taking control of seven domains, law enforcement aims to disrupt access to infrastructure allegedly used to conduct cyberattacks. It does not establish that every system connected to the suspected activity has been secured or that all potential victims have been identified.
The allegations outlined by US authorities should also be distinguished from a final judicial determination of responsibility. The Justice Department’s announcement described the suspected activities and the basis for the operation, while further investigations may clarify additional details.
For organisations, the incident is a reminder that cybersecurity requires ongoing attention. Security teams need to identify weaknesses, apply updates promptly, restrict unnecessary access and maintain procedures for responding to suspected breaches.
Individuals can also reduce some risks by using unique passwords, enabling multifactor authentication and treating unexpected links or attachments with caution. Organisations should provide clear reporting channels so employees can quickly flag suspicious messages or unusual account activity.
International cooperation is another important element in responding to cross-border cyber threats. Investigations may require coordination among law enforcement agencies, technology providers and security teams in multiple countries to identify infrastructure and limit further harm.
The US action against the China-linked hacking infrastructure highlights the continuing challenge of protecting computer networks. Disrupting suspected malicious tools can limit their immediate usefulness, but long-term protection depends on effective security practices, information sharing and sustained monitoring.
Source: ANI
Your trusted source for news, updates, and insights from India and around the world.
Copyright © 2020–2026 NEWSHOTS. All Rights Reserved.
