China-linked hackers breach US contractors, universities

Chinese state-linked hackers, operating under the group name QTFY, have been identified as responsible for a significant data theft operation impacting over 300 organizations. The targets included U.S. defense contractors, financial institutions, universities, and three Department of Energy laboratories, along with the National Institutes of Health and an HHS agency. These breaches occurred prior to the group taking their hacking platforms offline this week.

QTFY employed a strategy of mass internet scanning combined with a network of compromised devices to mask the origin of their attacks. This allowed them to blend malicious traffic with legitimate local activity, making their operations harder to trace. The FBI seized three domains essential to QTFY's main platforms, QScan, which identified vulnerable systems, and QTRouter, which anonymized the hackers' identities.

In May 2024, QTFY exploited a Check Point vulnerability to steal data from more than 300 organizations globally. Later, in September 2024, they leveraged zero-day flaws in Ivanti Cloud Services Appliance software. This allowed them to gain access to critical U.S. infrastructure, including energy labs and health agencies, although the specific data stolen and the duration of access remain undisclosed.

The disruption of QTFY's operations adds to a series of actions taken by the FBI against Chinese government-linked hacking groups. Previous operations have targeted and dismantled botnets and other infrastructure used by groups like APT 41, Flax Typhoon, and Mustang Panda, underscoring ongoing efforts to combat state-sponsored cyber threats.