U.S. Authorities Seize Two China‑Linked Hacking Tools Used Against Global Infrastructure

Federal investigators announced this week that the Department of Justice and the Federal Bureau of Investigation have seized two sophisticated cyber‑espionage tools, Microscan and FishHub, that were traced back to a Beijing‑based operation known as Integrity Tech.

Both programs are believed to have been designed and maintained by the Chinese firm, which has been linked to a series of intrusions targeting critical infrastructure sectors around the world. Microscan reportedly provided remote access capabilities, while FishHub functioned as a data‑exfiltration platform that could harvest sensitive operational information from compromised networks.

Security analysts say the tools were employed in campaigns that affected utilities, transportation systems, and manufacturing facilities across multiple continents. The covert nature of the attacks made it difficult for victims to detect the breaches until after significant data loss or service disruption had occurred, underscoring the growing threat posed by state‑aligned cyber actors.

According to a joint statement from the DOJ and FBI, the seizure was the result of a coordinated investigation that began months ago and involved collaboration with international partners. Law enforcement officials were able to infiltrate the command‑and‑control infrastructure used to manage Microscan and FishHub, ultimately disabling the tools and gathering evidence for potential prosecution.

The operation arrives amid heightened scrutiny of China’s cyber activities, following high‑profile incidents that have drawn accusations of espionage and sabotage. U.S. officials have repeatedly warned that malicious cyber tools aimed at critical sectors can have real‑world consequences, from power outages to compromised public safety systems.

While no arrests have been announced, authorities indicated that the investigation remains active and that additional assets associated with Integrity Tech may be targeted. The seizure is being presented as a warning to foreign actors that the United States will continue to pursue and dismantle cyber‑weapons that threaten national and global security.