China-Linked Hackers Hijacked US Federal Agencies

Federal agencies in the United States have been targeted by Chinese state-sponsored hackers who infiltrated systems using a network of compromised Internet of Things (IoT) devices. The compromised devices included routers, security cameras, and smart appliances.

The Justice Department and FBI announced on Wednesday the successful execution of a court order that shut down three internet domains critical to the hacking operations. This action disrupts the activities of a mysterious Chinese group identified as QTFY.

QTFY actors, reportedly including former members of China's People's Liberation Army, have developed hacking tools since 2018. Investigations indicate they exploited VPN vulnerabilities and scanned for network weaknesses to breach federal networks, including NASA and the Department of Energy.

The hackers created two platforms, QScan and QTRouter. QScan was designed to scan and infect thousands of IoT devices globally, incorporating them into the QTRouter network. This network served to mask the true location of the Chinese hackers.

Federal investigators revealed that QTFY offered its hacking services to paying customers, allegedly including China's Ministry of State Security and the People's Liberation Army. One specific campaign in September 2024 exploited a zero-day vulnerability in Ivanti Cloud Services Appliance against government agencies and a US security device manufacturer.

The seizure of the domains qtproxy.xyz, qt-proxy.org, and qt-team.com rendered QScan and QTRouter inoperable. The FBI has issued an advisory detailing QTFY's activities, which also targeted defense, telecommunications, and higher education sectors.