Summary
The FBI has disrupted a network of hacking tools deployed by Chinese state-sponsored threat actors against US critical infrastructure, in a court-authorized operation targeting infrastructure used by the threat actor groups attributed to Chinese state direction. The operation disabled tools and command-and-control infrastructure used to maintain persistent access to compromised US critical infrastructure networks. The disruption is part of ongoing FBI and DOJ efforts to counter Chinese state-sponsored cyber operations targeting US energy, water, transportation, and telecommunications infrastructure.
Timeline
| Date | Event |
|---|---|
| 2023-2026 | Chinese state-sponsored threat actors deploy hacking tools against US critical infrastructure; FBI investigates |
| Oct 9, 2026 | FBI court-authorized operation disrupts Chinese hacking tool network; BleepingComputer reports |
What Happened
Chinese state-sponsored threat actor groups attributed to operations including Volt Typhoon and Salt Typhoon have been documented maintaining persistent access to US critical infrastructure networks since at least 2021. These operations focus on pre-positioning within critical infrastructure for potential use in a conflict scenario rather than immediate data theft — the objective is to have the capability to disrupt or disable critical infrastructure on demand. The FBI’s disruption operation targeted the command-and-control infrastructure and hacking tools used to maintain this persistent access.
Court-authorized disruption operations of this type typically involve the FBI obtaining legal authority to access and disable attacker-controlled infrastructure, removing malware from compromised devices, and disrupting the command-and-control channels through which attackers communicate with their implants. The disruption does not eliminate the underlying threat actor capability or prevent re-compromise of the same infrastructure — it removes the specific tooling deployed in this campaign and forces the threat actor to rebuild their access from the beginning. Critical infrastructure operators whose networks may have been included in the compromised set should work with CISA and the FBI to verify whether their systems were affected and conduct forensic review.
Note on Domain Intelligence
Chinese state-sponsored threat actors do not operate legitimate clearnet infrastructure. No single commercial domain is the primary subject of this bulletin.