CYBERSECURITY
U.S. says Chinese hackers breached multiple federal agencies
The U.S. Justice Department and FBI say they disrupted a China-linked hacking campaign that breached or targeted multiple federal agencies by seizing internet domains used by two tools, QScan and QTRouter, tied to a Nanjing-based tech company.
The U.S. Justice Department and FBI say they disrupted a China-linked hacking campaign that breached or targeted multiple federal agencies by seizing internet domains used by two tools, QScan and QTRouter, tied to a Nanjing-based tech company.
What This is
- The Justice Department said a China-linked hacking operation compromised or targeted U.S. government agencies including NASA, the Federal Reserve, the Justice Department, and the U.S. Senate.
- U.S. officials said the campaign also hit or probed critical services and companies, including hospitals, power companies, telecom providers, defense contractors, and other sensitive networks.
- Authorities seized internet domains linked to two platforms, QScan and QTRouter, which they say helped attackers break in and hide where the attacks came from.
- Court filings and DOJ statements tied the infrastructure to Nanjing Xinjiuwei Network Technology Company and to a group U.S. officials call QTFY.
- U.S. authorities alleged the operation served Chinese state clients, including China’s Ministry of State Security and the People’s Liberation Army.
- Officials said the tools were used to hijack large numbers of internet-connected devices and route attacks through them, making intrusions harder to trace.
- The Justice Department said the activity dates back to at least 2018 and included targeting agencies such as the Department of Energy, HHS, and NIH.
- U.S. officials said they plan to release or have released guidance to help organizations spot the attackers’ methods, including technical indicators of compromise.
Why This Matters
- If attackers can reach agencies like NASA, the Fed, and the Senate, it raises the risk of stolen sensitive data and long-term spying.
- Using hijacked internet-connected devices as “cover” makes it harder to find who is behind an attack and to stop follow-on intrusions.
- Seizing domains can disrupt operations quickly, but it may not deter future campaigns if the people running them face little personal cost.
- Claims of ties to Chinese intelligence and the military can escalate tensions and shape how the U.S. responds to cyber activity short of war.