US Seizes Seven Domains to Cut Off Chinese Cyberattack Channels

U.S. law enforcement agencies recently announced the seizure of seven domains to dismantle the hacking infrastructure used by the Chinese information technology firm Yongsin Zhicheng Technology Group. The operation, conducted jointly by the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) under the authorization of the Bureau of Industry and Security (BIS) within the U.S. Department of Commerce, resulted in the permanent removal of these domains from the internet. Under U.S. law, when domains are confirmed to have been used in illegal activities, the government is empowered to obtain registrant information, freeze the accounts, and thereby disrupt the command-and-control channels of hacking teams. This action marks a further intensification of U.S. law enforcement efforts in the cybersecurity domain.

Yongsin Zhicheng Technology Group, established in China, presents itself as an IT service provider but has been identified by intelligence agencies in multiple countries as a logistical supporter of state-sponsored cyberattacks. In 2023, the U.S. Department of Commerce added the company to the Entity List, prohibiting U.S. businesses from trading with it and restricting its access to American technology. Numerous reports indicate that Yongsin Zhicheng has provided infrastructure for several transnational cyberespionage operations, utilizing servers, domain names, and cloud services to conceal the origins of its attacks. These activities have not only involved the theft of commercial secrets but have also extended to intelligence gathering targeting military and government institutions.

On the technical level, the United States leveraged its regulatory authority over domain name registrars to freeze domains suspected of being used in cybercrime. Such domains are typically employed by hackers as command-and-control (C&C) servers or data transmission channels. The seizure forces attackers to seek or purchase new domains, thereby increasing their operational costs and risks. This measure not only severed Yongsin Zhicheng’s cyber pipelines but also had a cascading impact on the offensive actions of its partners, as many hacking teams often share the same domain and server resources.

This action occurred against the backdrop of persistently tense U.S.-China relations. Over the past year and a half, the United States has imposed sanctions on multiple Chinese technology companies, accusing them of participating in cyberespionage, intellectual property theft, and military intelligence collection. The U.S. Department of State and the Department of Homeland Security have repeatedly stated publicly that they will continue to utilize legal tools to curb the activities of state-sponsored hacking teams. The seizure of Yongsin Zhicheng’s domains represents a concrete implementation of this series of policies, indicating that the U.S. approach to combating cybersecurity threats through legal means has become more stringent and specific.

From a strategic perspective, this move not only weakened Yongsin Zhicheng’s cyberattack capabilities but also sent a clear signal to the global technology industry: any organization attempting to use the internet for illegal activities will face strict legal prosecution. For Chinese enterprises, failure to strictly adhere to international cybersecurity norms may result in similar domain freezes and commercial sanctions. For the United States, this action serves as a necessary measure to uphold sovereignty and security in global internet governance, while also establishing legal and technical precedents for potential future cyber conflicts.

(Source: Central News Agency)