DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.
The US Department of Justice revised its press release to list NASA, the Federal Reserve, Department of Energy, DoJ, HHS, NIH and the US Senate as 'among the targets' of QTFY (aka QT AND QTCYBER), rather than victims. QTFY, active since 2018 and linked to Nanjing Xinjiuwei Network Technology Co with payments suggesting MSS sponsorship, operates the QScan vulnerability scanning platform and QTRouter obfuscation network, which underpin the Fast Labyrinth encrypted ORB relay network built from infected IoT devices and leased VPSs. The FBI seized qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com, disrupting QScan and QTRouter, while Lumen Black Lotus Labs reported the actor industrialized ORB networks for China-linked espionage. A 2019 NASA intrusion attempt exploited CVE-2019-11510, a critical Pulse Secure VPN flaw.
- DoJ rewording suggests agencies were targeted, not necessarily compromised
- QTFY operates QScan scanning and QTRouter obfuscation as a 'technical quartermaster'
- FBI seized QTFY proxy domains, neutralizing Fast Labyrinth ORB infrastructure
- Black Lotus Labs says QTFY industrialized ORB networks using IoT botnet nodes and VPSs
- 2019 NASA intrusion attempt used CVE-2019-11510 in Pulse Secure VPN
- CVEs
- CVE-2019-11510
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1595.002 Vulnerability ScanningT1584.005 Compromise Infrastructure: Botnet
- Vendors
- Pulse SecureLumen
- Products
- QScanQTRouterPulse Secure VPN
- Threat actors
- QTFY
- Victims
- NASA
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 31, 2026 Cyber Espionage / IoT Botnet The U. S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.