Chinese-backed hackers targeted NASA, Fed, Justice Department, Senate: US court documents

Chinese state-sponsored hackers used two platforms to target NASA, the Federal Reserve, the Justice Department, and the US Senate, according to court documents unsealed Wednesday.

The hackers also targeted the Energy Department, Department of Health and Human Services, and National Institutes of Health, said the Justice Department.

US authorities seized three domains used by the QScan and QTRouter platforms, rendering both systems inoperable. The platforms were allegedly created and operated by a Chinese-based group known as QTFY, which worked for the Nanjing Xinjiuwei Network Technology Company.

The company carried out malicious cyber activities on behalf of the Chinese government and received payments from the Ministry of State Security, according to an FBI affidavit filed in the Southern District of California.

QTFY allegedly offered hacking services to customers, including the Ministry of State Security and the People’s Liberation Army.

QScan scanned the internet for vulnerable devices and automatically infected thousands worldwide. The compromised devices were then added to QTRouter, a network that allowed hackers to conceal the origin of their attacks.

By routing malicious traffic through infected devices near their targets, the hackers could make attacks appear to originate from legitimate local users, said the affidavit.

The group also targeted hospitals, telecommunications providers, power companies, financial institutions, and defense contractors.

The FBI investigated an attempted QTFY intrusion into space agency NASA’s network in 2019. The attack failed because NASA had already patched the vulnerability the hackers sought to exploit.

US Attorney General Todd Blanche said the operation disabled Chinese state-sponsored malicious software, with FBI Director Kash Patel describing it as the disruption of a “global botnet and hacking platform.”

The FBI and National Security Agency also released a cybersecurity advisory on QTFY activity dating to at least 2018.