FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
The DOJ and FBI seized domains hard-coded into QScan and QTRouter, two platforms operated by China-based Nanjing Xinjiuwei Network Technology Company on behalf of state-sponsored group QTFY. QScan automatically infected thousands of IoT devices which were added to QTRouter, an obfuscation network routing malicious traffic through compromised and proxy devices outside China. Targets included NASA, the Federal Reserve, Departments of Energy, Justice, and HHS, NIH, and the US Senate, exploiting flaws in Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Log4j, and others.
- FBI seized hard-coded domains, making both platforms inoperable
- QScan infected thousands of IoT devices for QTRouter proxy net
- Victims include NASA, Federal Reserve, DOJ, Senate, HHS
- Exploited Fortinet, Citrix, Exchange, F5, Log4j flaws
- Lumen described QTFY as a 'digital quartermaster'
- ATT&CK
- T1595 Active ScanningT1190 Exploit Public-Facing ApplicationT1090.001 Proxy: Internal ProxyT1583.002 Acquire Infrastructure: DomainsT1071.001 Application Layer Protocol: Web Protocols
- Threat actors
- QTFY
From the original article
5 min read at securityaffairs.com
FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U. S. critical infrastructure.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.