Washington: The US Justice Department and Federal Bureau of Investigation (FBI) on Wednesday seized internet domains supporting two China-linked hacking platforms accused of targeting National Aeronautics and Space Administration (NASA), the Federal Reserve, the Justice Department and the US Senate.
The court-authorised action disabled QScan and QTRouter, two complementary platforms allegedly used to penetrate American critical infrastructure and other sensitive networks.
Court documents unsealed in the Southern District of California attributed the platforms to QTFY, which US authorities described as a state-sponsored Chinese hacking group.
QTFY was employed by Nanjing Xinjiuwei Network Technology Company, a China-based technology company, according to the Justice Department.
US authorities alleged that the group offered computer-hacking services to paying customers, including China’s Ministry of State Security and People’s Liberation Army.
The identified targets included the NASA, Federal Reserve, Energy Department, Justice Department, Department of Health and Human Services, National Institutes of Health and US Senate.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Attorney General Todd Blanche said.
“We are here to ensure security for the American people and will use every tool we have to keep that promise,” he said.
Blanche said federal investigators had disabled the Chinese group’s malicious software as part of a series of operations against hacking activity allegedly sponsored by Beijing.
According to the court documents, QScan searched for and automatically infected thousands of internet-connected devices around the world.
Those devices were then incorporated into QTRouter, a network controlled by the hacking group. The network also used commercial proxy services and leased virtual private servers.
The platform enabled hackers to conceal the Chinese origin of their activities, the department said.
Malicious communications appeared to originate from compromised computers located outside China and, in some cases, near the targeted network.
The seized domains had been built into both malware platforms and were required for communication, authentication and other essential functions.
Taking control of those domains rendered QScan and QTRouter inoperable, according to the department.
“Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target US critical infrastructure,” FBI Director Kash Patel said.
“These tools were used by People’s Republic of China (PRC) cyber actors to hide the origin of their attacks,” he added.
The FBI and National Security Agency also issued a cybersecurity advisory containing indicators that could help organisations detect possible QTFY activity.
(IANS)
