Justice Department and FBI seize China-linked cyber tools used in hacking campaigns

How the Tools Were Used in Cyber Espionage

Washington, D. C. — On October 8, 2026, the U. S. Justice Department and FBI announced court-authorized seizures of vulnerability scanning and spear phishing infrastructure operated by China-state sponsored hackers. The action targeted digital tools used to identify and exploit weaknesses in American networks, including government and private sector systems. Officials said the move aims to disrupt ongoing malicious cyber activity and protect critical assets from foreign espionage.

The seized infrastructure included custom-built scanners designed to probe for unpatched software flaws and phishing kits tailored to trick employees into revealing credentials. Investigators linked these tools to hacking groups believed to be working under the direction of the Chinese Ministry of State Security. Court filings revealed the infrastructure had been used in multiple campaigns targeting defense contractors, technology firms, and research institutions over the past 18 months. FBI cyber division officials stated the tools were hosted on servers leased through third-party providers to obscure their origin.

What Legal Authority Enabled the Seizure?

According to court documents, the vulnerability scanners automated the process of identifying outdated systems exposed to the internet, allowing attackers to prioritize targets with known weaknesses. Once a vulnerability was found, spear phishing emails were sent to specific individuals within those organizations, often mimicking internal communications to increase success rates. These emails contained malicious links or attachments that, when clicked, installed malware granting long-term access to the victim’s network. The DOJ emphasized that the seized tools were not generic but specifically adapted for high-value targets in sectors deemed strategic by Beijing.

The operation was conducted under a federal warrant issued by a district court, authorizing the seizure of domains and server infrastructure tied to the malicious activity. The warrant was based on evidence gathered through months of surveillance, including traffic analysis and malware reverse engineering. Officials noted that the legal framework allowed action without requiring the physical location of the servers, focusing instead on control and use of the infrastructure. This approach reflects a growing strategy to dismantle cyber threats at their technical source, regardless of geographic hosting.

What specific types of data were the hackers trying to steal? Investigators indicated the campaigns focused on intellectual property, technical schematics, and sensitive communications related to national defense and advanced technology sectors.

Frequently Asked Questions

Were any U. S. agencies directly compromised by these tools? While the DOJ confirmed the tools were used in attempts to breach networks, it stated no successful intrusions into federal systems were attributed to this specific infrastructure during the period of surveillance.

Will the seizure permanently stop these hacking groups? Officials cautioned that while the seizure disrupts current operations, the groups may rebuild using new infrastructure, underscoring the need for ongoing vigilance and international cooperation to counter state-sponsored cyber threats.