US Seizes Chinese Hacking Platforms That Hit NASA, Senate

The US Department of Justice and FBI announced on Aug. 26 that they had seized web domains used to operate QScan and QTRouter, two hacking platforms authorities say were run by QTFY, a group linked to China's Ministry of State Security and the People's Liberation Army.

QScan scanned the internet for vulnerable, internet-connected devices and infected them with malware. The compromised devices were then folded into QTRouter, a network that routed attack traffic through them, letting the operators disguise attacks as originating elsewhere rather than China, according to the DOJ.

Officials said the platforms were used against NASA, the Federal Reserve, the Departments of Energy, Justice and Health and Human Services, the National Institutes of Health and the US Senate, along with power companies, hospitals, financial institutions, defense contractors and universities. "State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted," Attorney General Todd Blanche said. FBI Director Kash Patel said the bureau had disrupted "a global botnet and hacking platform used by Chinese state-sponsored hackers."

The DOJ says the campaign dates back to at least 2018, based on a related FBI and NSA security advisory. Seizing the domains, which were hard-coded into the malware, rendered both platforms inoperable, though no individuals have been charged and security researchers expect QTFY to rebuild its infrastructure rather than stop operating.