US Seizes Chinese Hacker Domains Targeting NASA, Senate

The US Justice Department has seized several internet domains allegedly used by Chinese state-sponsored hackers to target critical infrastructure in the US, including NASA, the Federal Reserve, and the US Senate.

The hacking platforms, known as QScan and QTRouter, were used to infiltrate several US government institutions, including the National Institutes of Health and the departments of energy, justice, and health and human services.

According to court documents, the hacking group, known as QTFY, provides computer hacking services to paying customers, including China's Ministry of State Security and the People's Liberation Army.

The Justice Department said QTFY was employed by China-based technology firm Nanjing Xinjiuwei Network Technology Company.

Apart from government institutions, the hackers allegedly targeted private-sector infrastructure, including hospitals, universities, telecommunications providers, power companies, financial institutions, and defence contractors.

Attorney General Todd Blanche said in a statement that federal law enforcement investigated and disabled the malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People's Republic of China.

The QScan platform searched for and automatically infected thousands of internet-connected devices worldwide, which were then incorporated into QTRouter, a network controlled by the hacking group.

The seized domains were integrated into both malware platforms and were necessary for communication, authentication, and other essential functions, rendering QScan and QTRouter inoperable.

FBI Director Kash Patel said the operation disrupted a global botnet and hacking platform used by Chinese state-sponsored hackers to target US critical infrastructure.

The FBI and National Security Agency (NSA) also issued a cybersecurity advisory with indicators that could help organisations identify possible QTFY activity.

This incident highlights the ongoing threat of cyberattacks from state-sponsored hackers and the importance of cybersecurity measures to protect critical infrastructure.

The US government's actions to disrupt and dismantle these hacking platforms demonstrate its commitment to protecting national security and preventing future cyberattacks.

The incident also underscores the need for increased cooperation and information sharing between governments and private sector organisations to combat the growing threat of cyberattacks.