The United States Justice Department and the FBI announced late last week the seizure of several domains and internet infrastructure linked to a pair of sophisticated intrusion tools used by China-backed state actors to target domestic and foreign critical infrastructure entities.
“These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims’ vulnerabilities,” US Attorney Troy Rivetti of the Western District of Pennsylvania said in an 8 October statement.
The law enforcement operation successfully blocked access to the intrusion tools – Microscan and FishHub – linked to Integrity Technology Group (Integrity Tech), a Chinese firm known to take contracts from the PRC government.
“These seizures, our second disruption of Integrity Tech’s massive operations in as many years, send another clear message to cyber criminals from the PRC and elsewhere of the Department’s dedication to defending and maintaining cyber security in the United States and abroad,” Rivetti said.
Court documents allege Integrity Tech used a Mirai-based botnet and its Microscan tool to scan networks for vulnerabilities, targeting US power infrastructure, Japanese and Polish airports, Taiwanese energy companies and universities, and an international NGO.
FishHub, on the other hand, was allegedly used to enable spear-phishing attacks, deliver malware for remote access and data theft, and target around 20 Taiwanese universities. Integrity Tech also allegedly used unauthorised remote administration software to connect victims’ networks to its own servers.
“Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting US and foreign critical infrastructure,” Assistant Director Brett Leatherman of the FBI’s cyber division said.
“The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”
The FBI’s San Diego and Baltimore field offices are continuing to investigate the case, in coordination with the FBI’s cyber division.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
