Officials disrupt Chinese espionage operation that hit multiple federal agencies
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
Authorities seized three domains powering QScan and QTRouter, the hacking suite of QTFY, a Chinese government-funded group operating through front company Nanjing Xinjiuwei Network Technology. Targets include the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, NIH, financial institutions, defense contractors, utilities, telecoms, and hospitals; the group exploited zero-days in Ivanti, Pulse Secure, Fortinet, Citrix, and others, intruding three DOE national labs in September 2024. QScan carried over 200 proof-of-concept exploits and processed more than two million scanning tasks in a single day in 2024.
- QTFY exploited Ivanti zero-days in September 2024 to hit DOE national labs, NIH, and HHS
- QScan reconnaissance tool included 200+ PoC exploits; 2M+ tasks processed in one day
- Group includes former PLA members and ran undetected for more than eight years
- Joint FBI, NSA, and Cyber National Mission Force advisory released with indicators of compromise
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1595.002 Vulnerability ScanningT1584.005 BotnetT1090 Proxy
- Threat actors
- QTFY
- Countries
- ChinaUnited States
From the original article
4 min read at cyberscoop.com
The full hacking suite, seized by authorities, allowed Chinese government funded attackers to intrude highly sensitive networks undetected for more than eight years. Federal authorities Wednesday revealed a multi-layered Chinese state-sponsored espionage operation that’s targeted and compromised U. S.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.