Hackers abused IoT devices to break into multiple US departments
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
As part of a disclosure into the Justice Department and FBI operations to prevent Chinese threat actors from accessing a malicious botnet and hacking platforms, the US Office of Public Affairs has revealed that the hackers managed to breach computers belonging to multiple US government departments.
The disclosure said the victims of “computer intrusion” included the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and the US Senate.
The Chinese hackers created a platform that provides paid-for hacking services on behalf of its customers. The two services, QScan and QTRouter, detect and infect internet-connected devices to use as part of a proxy network that obscures the origins of internet traffic, allowing Chinese hackers to slip into networks without detection.
The Chinese state-sponsored hacking group the Justice Department and FBI have disrupted is named in court documents – unsealed by the Southern District of California – as “QTFY”.
QTFY was apparently hired by the Nanjing Xinjiuwei Network Technology Company, to create and operate the QScan and QTRouter operations, while using both systems to infiltrate US critical infrastructure.
“Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure,” said FBI Director Kash Patel.
“These tools were used by PRC cyber actors to hide the origin of their attacks. Thanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down. Today’s action is just the latest technical operation against PRC-sponsored hacking – and in support of President Trump’s Cyber Strategy for America, the FBI is surging efforts to shape adversary behavior and defend the homeland in cyberspace.”
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The authorization to disrupt the operation of QTFY comes as part of a range of technical operations designed to disrupt the ability of the People’s Republic of China to launch hacking activities on US government systems and critical infrastructure
Previous operations include the removal of the PlugX malware from thousands of US computers, alongside operations to disrupt Chinese botnets leveraging millions of unsecured IoT devices.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.
Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.
