FBI seizes domains linked to Chinese hacking tools as seven governments warn of attacks

The FBI has seized seven domains linked to hacking tools that authorities say were used by Chinese government-backed operators to scan critical infrastructure. A joint advisory from seven governments warns that compromised devices and other tools are being used to target organisations and steal sensitive data, according to The Register.

Watch Desk analysis

What happened

The Register reports that the FBI seized the domains under court authority. The FBI and agencies in the UK, US, Australia, Canada, Japan, New Zealand and Spain then warned about activity they attribute to attackers enabled by Chinese security firm Integrity Technology Group. Those are the agencies’ allegations as reported by The Register, not a finding of guilt.

The article says CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199 and CVE-2023-22894. The Register also reports that court documents allege the operators used scanning tools, malware and other intrusion tools, including to target a South Carolina power company and organisations in Taiwan, Japan and Poland.

Who is affected

• Organisations with exposed systems affected by the listed vulnerabilities
  CISA’s addition of five CVEs to its exploited-vulnerabilities catalogue makes checking affected products and applicable mitigations a practical next step.
• Operators of connected devices and critical infrastructure
  The reported warning describes compromised devices being used to scan networks and support further attacks.

Why it matters

This is not just a takedown of a handful of internet domains. The reported operation involved a botnet built from compromised devices, while the advisory warns that attackers are targeting organisations worldwide. Seizing infrastructure can disrupt an operation; it does not, by itself, remove vulnerable devices or settle whether the same operators have other routes in.

The five CVE identifiers give security teams something concrete to check against their own systems. The article does not provide product-by-product exposure or remediation steps, so the identifiers are a starting point, not a ready-made patch list.

Our read

The domain seizure is significant, but the useful work starts on the less cinematic side: checking whether affected systems are exposed and following the relevant vendor and CISA guidance. The Register’s account ties the warning to named agencies and court documents; the allegations should remain allegations until established through the relevant proceedings.

What to watch

• Whether CISA or affected vendors publish further detail on products and mitigations for the five CVEs.
• Whether authorities disclose more about the seized domains, the alleged operators or affected organisations.
• Whether the joint advisory reports continued activity after the disruption.

Discussion spark: Should security agencies prioritise disrupting attackers’ infrastructure, or put more effort into helping organisations find and fix the vulnerable devices those operations exploit?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.