E-Paper
Chinese hackers broke into US Justice Department, NASA, Senate and more, say officials
The US Justice Department said in a statement that the Chinese hacking operation used two platforms, dubbed ‘QScan’ and ‘QtRouter’.
Prefer HTon Google
Some of the top US government departments and agencies, including NASA, the Federal Reserve, the US Senate and the Justice Department among other agencies, were targeted in a hacking campaign allegedly carried out by Chinese hackers.
The Justice Department said in a statement that the two hacking platforms, dubbed ‘QScan’ and ‘QtRouter’, were used by a Chinese group named ‘QTFY’.
An affidavit identified the US Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and four unnamed companies in the US and South Korea as among the victims.
Also Read | UK power plant shuts down for 4 days after suspected cyber attack from Iran: Report
The Justice Department said 'QTFY' was operated by a China-based firm, Nanjing Xinjiuwei Network Technology Company, whose clients it said included China's civilian intelligence agency, the Ministry of State Security, and its military, the People's Liberation Army.
The statement said the group's computer infrastructure had been used to compromise critical infrastructure and other sensitive networks in the US and around the world since at least 2018.
Experts who track Chinese cyber activity said private contractors routinely carry out high-profile intrusions on behalf of various Chinese government agencies, said a Reuters report.
"Over the last decade, the number of companies offering niche offensive services has exploded," said Dakota Cary, a China analyst with cybersecurity company SentinelOne.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise,” said Attorney General Todd Blanche. “Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China.”
“Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure,” said FBI Director Kash Patel.
Previous major breach raised concerns over Chinese cyber activity
The latest allegations come amid growing concerns over sophisticated cyber operations linked to China and their potential impact on US government agencies and critical infrastructure.
In a major incident reported last year, a potentially ‘catastrophic’ breach of Seattle-based cybersecurity company F5 Inc. was blamed on state-backed hackers from China.
F5 disclosed in a regulatory filing that nation-state hackers had breached its networks and gained ‘long-term, persistent access’ to certain systems. The attackers stole files containing portions of source code from the company's BIG-IP suite of application services, which are widely used by Fortune 500 companies and government agencies.
The hackers also obtained details about some vulnerabilities that could potentially be exploited to target F5's customers. Representatives for F5 told customers that the attackers had remained inside the company's network for at least 12 months, according to people familiar with the matter who spoke on condition of anonymity because they were not authorised to discuss the incident publicly.
Chinese hackers broke into Treasury dept in Dec 2024
In December 2024, Chinese state-sponsored hackers breached the US Treasury Department's cybersecurity safeguards in what officials described as a 'major incident'.
The attackers compromised third-party cybersecurity provider BeyondTrust and accessed unclassified Treasury documents. According to a letter sent to lawmakers, the hackers obtained a key used to secure a cloud-based service, allowing them to bypass security measures, remotely access certain Treasury workstations and view documents maintained by department users.
