The Justice Department (DOJ) and Federal Bureau of Investigation (FBI) said on Aug. 26 that they seized domains used by two China-linked hacking platforms that targeted multiple federal agencies, the U.S. Senate, and critical infrastructure networks.
DOJ said in an Aug. 26 press release that the court-authorized seizures rendered the hacking platforms, known as QScan and QTRouter, inoperable.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise,” said Attorney General Todd Blanche.
“Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China,” Blanche added.
Federal authorities attributed the platforms to QTFY, a People’s Republic of China state-sponsored hacking group operating through Nanjing Xinjiuwei Network Technology Company. DOJ said the group offers hacking services to China’s Ministry of State Security and People’s Liberation Army.
The department identified networks associated with NASA, the Federal Reserve, the departments of Energy, Health and Human Services, DOJ, the National Institutes of Health, and the U.S. Senate among the group’s targets and victims.
In an accompanying video announcement, the FBI said QTFY had targeted government agencies, power companies, telecommunications providers, and hospitals for nearly a decade. The group routed malicious traffic through everyday devices in more than 130 countries, according to the bureau.
The FBI, National Security Agency, and Cyber National Mission Force also issued a joint cybersecurity advisory detailing QTFY’s malicious distributed systems and providing information intended to help network defenders identify and mitigate the activity.
The operation follows earlier FBI actions against China-linked cyber infrastructure, such as the disruption of the Flax Typhoon botnet.
“We’re taking the fight to PRC sponsored cybercriminals to protect the critical services Americans rely on every day,” said U.S. Attorney Adam Gordon for the Southern District of California.
According to the press release, the FBI’s San Diego Field Office and Cyber Division, the U.S. Attorney’s Office for the Southern District of California, and the National Security Cyber Section of the DOJ’s National Security Division investigated this hacking activity and led the disruption effort.