FBI takes down China-linked hacking network behind attacks on NASA, DOJ and U.S. Senate
FBI seized domains disabling QScan and QTRouter malware run by China-linked QTFY group behind intrusions at NASA, DOJ, Senate and other agencies.
The Justice Department and FBI seized domains hard-coded into two malware tools, QScan and QTRouter, operated by a Chinese state-sponsored group called QTFY, tied to a Nanjing-based company that sold hacking services to China's Ministry of State Security and the PLA. QScan infected IoT devices worldwide while QTRouter combined them with commercial proxies and rented servers to build an obfuscation network that masked attack origins. Victims include NASA, the Federal Reserve, the Departments of Energy and Justice, HHS, NIH, and the U.S. Senate. The FBI and NSA published a joint advisory with indicators of compromise, the latest in operations against Mustang Panda, Flax Typhoon, and Volt Typhoon infrastructure.
- QScan infected IoT devices; QTRouter built an obfuscation proxy network for attacks
- Domain seizures made both malware tools inoperable for the group
- QTFY sold hacking services to China's MSS and PLA, targeting US agencies
- Follows prior FBI operations against Mustang Panda, Flax Typhoon, Volt Typhoon botnets
- FBI and NSA released a joint advisory with IOCs
From the original article
2 min read at helpnetsecurity.com
The Justice Department and FBI have seized domains tied to two hacking tools built and run by a Chinese state-sponsored group, cutting off access to malware that had been used against U. S. government agencies for years.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.