The Justice Department and FBI announced on Oct. 8 that they had seized seven internet domains used by Chinese state-linked hackers to target critical infrastructure and other computer networks in the United States and overseas.
The seizures targeted two hacking tools allegedly operated by cyber actors working for Integrity Technology Group, a Beijing-based cybersecurity company with Chinese regime contracts.
The tools were used to identify security weaknesses, gain unauthorized access to computer networks, and steal information, according to the Justice Department.
In a joint cybersecurity advisory released the same day, U.S. and allied agencies warned that Chinese regime-linked hackers enabled by Integrity Tech had combined automated scanning, large networks of compromised devices, and targeted intrusions to steal sensitive information from organizations worldwide, including U.S. critical infrastructure operators.
A federal magistrate judge in Pennsylvania approved the seizure warrant on Oct. 6, authorizing the domains to be redirected to FBI-controlled servers.
The Justice Department has not announced criminal charges against Integrity Tech or identified individual defendants in connection with the seizures.
The operation marks the second public U.S. disruption of Integrity Tech’s hacking infrastructure in two years.
In September 2024, the FBI dismantled a network of more than 200,000 infected internet-connected devices, including home routers and cameras, that investigators said were used to conduct cyber operations.
However, a newly unsealed FBI affidavit indicates that tools linked to Integrity Tech remained accessible afterward.
Investigators found a server hosting one hacking tool in March 2026 and confirmed that a login page for another was still accessible in September.
“The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” said Brett Leatherman, assistant director of the FBI’s Cyber Division, referring to the People’s Republic of China.
“By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”
