It marks the first use of the Protecting American Intellectual Property Act, targeting a firm accused of brokering stolen U.S. cyber tools.