US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate
DOJ takes down QScan and QTRouter Chinese obfuscation platforms used to breach Federal Reserve, DOE, DOJ, and Senate since 2018.
The DOJ and FBI seized domains hard-coded into QScan and QTRouter, platforms run by Nanjing Xinjiuwei Network Technology Company and used by China's Ministry of State Security and PLA. QScan automatically infected IoT devices worldwide which were absorbed into QTRouter, allowing attackers to disguise intrusions as originating from other countries or local sources. Victims included the Federal Reserve, Department of Energy, DOJ, US Senate, NASA, HHS, NIH, plus hospitals, telecoms, power companies, financial institutions, and defense contractors. The FBI investigated QTFY since 2018, tracing a 2019 NASA incident through Pulse Secure VPN exploitation.
- Seized domains hard-coded into both platforms, inoperable now
- QTFY operated in 130+ countries as hackers-for-hire model
- 2019 NASA breach traced to Pulse Secure VPN exploit
- Investigation prompted by this year's attack on US Senate
- Follows prior PlugX, Volt Typhoon, Flax Typhoon takedowns
- ATT&CK
- T1595 Active ScanningT1190 Exploit Public-Facing ApplicationT1090.001 Proxy: Internal ProxyT1071.001 Application Layer Protocol: Web Protocols
- Vendors
- Pulse Secure
- Products
- Pulse Secure VPN
- Threat actors
- QTFYVolt TyphoonFlax Typhoon
- Malware
- PlugX
- Organizations
- FBIDOJMinistry of State SecurityPLA
From the original article
2 min read at therecord.media
Chinese government hackers used tools known as “QScan” and “QTRouter” to breach multiple federal agencies since 2018, the Department of Justice said in announcing the takedown of the platforms on Wednesday. The tools were run by China-based Nanjing Xinjiuwei Network Technology Company and used primarily by China’s Ministry of State Security and the People’s Liberation Army, the department said in an affidavit .
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.