DOJ and FBI Seize Microscan and FishHub Tools Used by China-Sponsored Hackers
Federal authorities seized two cyber tools used to scan and attack critical infrastructure networks linked to state-sponsored actors from China.
Key points
- The US Department of Justice and FBI executed court-authorized seizures of the Microscan and FishHub tools.
- These tools were used to scan and compromise U.S. and foreign critical infrastructure systems.
- The operation denies malicious cyber actors access to the infrastructure used for spear-phishing and vulnerability scanning.
The US Department of Justice and the Federal Bureau of Investigation announced on Tuesday that they have seized two cyber tools, Microscan and FishHub, which were operated by China-state sponsored hackers. The court-authorized actions were taken to deny malicious actors access to the infrastructure used to scan and hack networks.
At a glance
- Publisher
- US Department of Justice
- CVEs
- See advisory
According to the official advisory from the Justice Department, the seized tools were instrumental in scanning and, in some cases, hacking U.S. and foreign critical infrastructure systems. The operation targets the operational capabilities of the threat actors rather than just monitoring their activity. By seizing the tools, federal authorities aim to disrupt the ongoing campaigns that have targeted essential services and other networks.
Operational Context
The Microscan and FishHub tools served distinct but complementary functions in the attackers' workflow. As described in the Justice Department's statement, these instruments were used for vulnerability scanning and spear-phishing activities. The seizure represents a proactive measure to remove the means by which these actors identify and exploit weaknesses in target networks.
The advisory highlights that the tools were not merely used for reconnaissance but were also employed to execute hacks. This indicates a direct link between the seized infrastructure and successful intrusions into sensitive systems. The Justice Department emphasized that the seizures were authorized by the courts, ensuring that the legal framework supported the disruption of these cyber operations.
Targeted Sectors
The primary targets of the campaigns facilitated by Microscan and FishHub include critical infrastructure systems. The Justice Department noted that both U.S. and foreign entities were affected by the scanning and hacking activities. Critical infrastructure typically encompasses sectors such as energy, water, transportation, and healthcare, which are vital to national security and public safety.
The involvement of China-state sponsored hackers suggests a strategic motivation behind the attacks. State-sponsored groups often target critical infrastructure to gather intelligence, disrupt services, or establish persistent access for future operations. The seizure of these tools aims to mitigate the immediate threat posed by these specific instruments while signaling federal commitment to protecting essential services.
What should you do?
Security professionals should monitor for any residual activity related to Microscan and FishHub, although the primary infrastructure has been seized. Organizations should ensure that their vulnerability scanning and patch management processes are up to date to address any weaknesses that may have been previously exploited.
No specific software patches or updates were mentioned in the advisory, as the action focused on seizing the attackers' tools rather than fixing a specific software vulnerability. However, standard cybersecurity hygiene remains crucial. Entities in critical infrastructure sectors should review their access logs and network traffic for any signs of unauthorized scanning or spear-phishing attempts that may have occurred prior to the seizure.
What to do and how to stay safe: Microscan
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What tools did the FBI and DOJ seize?
The agencies seized two tools named Microscan and FishHub, which were used for vulnerability scanning and spear-phishing.
Who was behind the use of these tools?
The tools were operated and used by hackers sponsored by the Chinese state, according to the Justice Department.
Which systems were targeted by these attacks?
The attacks targeted U.S. and foreign critical infrastructure systems and other networks.
