U.S. seizes China-linked hacking platforms, then narrows who was breached

WASHINGTON, Aug 28 (Reuters) - U.S. officials are correcting earlier statements that several government agencies were hacked by Chinese hackers, now saying that the organizations were among the hackers' targets.

fact

A previous version of the statement said the government agencies had been among the hackers' victims.

fact

The distinction matters because it narrows the scope of confirmed breaches in what the DOJ described as a years-long Chinese cyber-espionage campaign against U.S. government agencies, defense contractors and other sensitive targets.

fact

A separate joint cybersecurity advisory issued by the FBI, National Security Agency and U.S. Cyber Command's Cyber National Mission Force published on Wednesday listed successful data thefts from unnamed defense contractors, financial institutions and universities in May 2024, and unsuccessful attempts to access networks of the U.S. Senate and a U.S. hospital in March 2026.

fact

A separate joint cybersecurity advisory issued by the FBI, National Security Agency and U.S. Cyber Command's Cyber National Mission Force published on Wednesday listed successful data thefts from unnamed defense contractors, financial institutions and universities in May 2024, and unsuccessful attempts to access networks of the U.S. Senate and a U.S. hospital in March 2026.

fact

Messages seeking clarification from the FBI and the Cybersecurity and Infrastructure Security Agency were not immediately returned on Friday.

fact

The Chinese Embassy in Washington did not immediately respond to a request for comment on Friday.

fact

The Federal Reserve, US Senate, and four unnamed companies in the US and South Korea were also identified as targets.

fact

The latest operation does not mean all the group’s activity has been eliminated, but the domain seizures will disrupt access to the platforms.

fact

Neither the Chinese embassy in Washington nor Nanjing Xinjiuwei responded to requests for comment by the Reuters news agency.

fact

In March, the FBI notified the US Congress that hackers had penetrated certain agency networks related to people under FBI investigation, with public reporting later attributing the compromise to China.

fact

Chinese-linked hackers have also been tied to a compromise of certain US House of Representatives committee networks, as well as multiple major telecommunications companies in recent years.

fact

The Justice Department and FBI have seized domains tied to two hacking tools built and run by a Chinese state-sponsored group, cutting off access to malware that had been used against U.S. government agencies for years.

fact

QScan and QTRouter worked as a pair.

fact

The Justice Department and the FBI on Wednesday filed an affidavit announcing the seizure of websites used by a Chinese state-sponsored group known as QTFY to attack networks at U.S. government agencies, hospitals, power companies and financial institutions.

fact

U.S. Senate systems were also targeted this year, according to the affidavit.

fact

According to the joint advisory, QTFY hackers attempted at least twice — once in 2019 and again in June — to identify vulnerabilities in networks of unnamed U.S. election systems.

In both cases, the hackers were unsuccessful.

fact

Hackers used a zero-day vulnerability to compromise the Energy Department, the NIH and HHS’ Health Resources and Services Administration in September 2024, per the advisory.

fact

Hackers used a zero-day vulnerability to compromise the Energy Department, the NIH and HHS’ Health Resources and Services Administration in September 2024, per the advisory.

fact

However, the group successfully installed malware in Taiwanese energy systems in 2021 and, that same year, exploited a common vulnerability to gain access to government systems in an unnamed U.S. state and at an undisclosed large U.S. retail company.

fact

However, the group successfully installed malware in Taiwanese energy systems in 2021 and, that same year, exploited a common vulnerability to gain access to government systems in an unnamed U.S. state and at an undisclosed large U.S. retail company.

fact

Many of the breaches were carried out to gain and maintain access to critical U.S. networks, the advisory added.

fact

Spokespeople for the Justice Department, NIH, the Energy Department and the Senate Sergeant at Arms — which oversees Senate IT networks — did not respond to a request for comment on the breaches.

fact

Chinese President Xi Jinping is scheduled to visit Washington next month, where cyberattacks against U.S. networks are likely to be brought up.

fact

In 2023, officials and industry experts said that the Chinese hacking group Volt Typhoon had carried out attacks against organizations on the U.S. mainland and at military bases in Guam since 2021, including communications, transportation and IT companies.

fact

Separate spokespeople for HHS and for the Federal Reserve declined to comment, also directing questions to the Justice Department.

fact

In 2024, a China-linked hacking group dubbed Salt Typhoon was accused of breaching U.S. telecommunications systems and the mobile devices of several U.S. officials, including then-presidential candidate Donald Trump and his running mate, JD Vance.

fact

Spokespeople for the Cybersecurity and Infrastructure Security Agency — the nation’s cyber defense and incident response agency — did not respond to a request for comment on how the federal government is responding to these attacks.

fact

Chinese hackers also gained access to the emails of top Biden administration officials at the Commerce and State departments in 2023.

fact

The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter. Among the targets of QTFY are the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and the U.S. Senate.

fact

The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter. Among the targets of QTFY are the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and the U.S. Senate.

fact

The FBI says a People’s Republic (PRC) of China-backed group called QTFY created and operated the two platforms, plus botnets of compromised IoT devices.

fact

On Monday, a US federal court granted seizure warrants for three domains linked to QTFY: qtproxy.xyz, qt-proxy.org, and qt-team.com.

fact

The QTRouter botnet – consisting of these compromised IoT devices, plus commercial proxy service devices, and leased virtual private servers – then serves as an obfuscation network, allowing QTFY and other criminals who pay for the service to conceal the origin of their digital intrusion activities, making these communications appear to originate from local computers.

fact

The FBI investigated an attempted computer intrusion at NASA in August 2019, during which the Chinese government snoops tried to exploit CVE-2019-11510, a critical vulnerability in Ivanti’s Pulse Secure VPN that allowed attackers to learn legitimate users' usernames and passwords, effectively granting them unauthorized access to protected networks.

fact

The FBI investigated an attempted computer intrusion at NASA in August 2019, during which the Chinese government snoops tried to exploit CVE-2019-11510, a critical vulnerability in Ivanti’s Pulse Secure VPN that allowed attackers to learn legitimate users' usernames and passwords, effectively granting them unauthorized access to protected networks.

fact

Ivanti patched the flaw in April 2019.

fact

Other victims in 2019 and 2020 include unnamed financial groups in Michigan and South Korea, and a Missouri insurance agency.

fact

The insurance agency attack abused a different vulnerability: CVE-2019-19781, a critical flaw in Citrix VPN products that allowed arbitrary code execution with no account credentials.

fact

As The Register previously reported, China also abused this bug as a zero-day to break into dozens of defense companies, government agencies, and financial organizations in America and abroad.

fact

The insurance agency attack abused a different vulnerability: CVE-2019-19781, a critical flaw in Citrix VPN products that allowed arbitrary code execution with no account credentials.

fact

A year earlier, in 2024, China’s Flax Typhoon burned down their own botnet consisting of hundreds of thousands of infected internet-of-things devices when confronted by the feds.

fact

The FBI did not respond to The Register’s inquiries, including how many computers QTFY compromised, and whether the crew has ties to any of China’s "Typhoon" groups.

fact

In June, however, Lumen’s Black Lotus Labs reported a “significant resurgence” of a botnet linked to Volt Typhoon, with this cluster of injected machines surging to 1,500 compromised routers and IoT devices.

fact