The U.S. government has disrupted a sprawling state-sponsored Chinese hacking operation that breached the networks of top government agencies, including the Federal Reserve, NASA, and the U.S. Senate, the Justice Department announced Wednesday. The operation, identified as 'QScan' and 'QTRouter,' was used by hackers linked to China to target U.S. critical infrastructure and other sensitive networks within the federal government.
Federal prosecutors stated that the Chinese-linked hackers also victimized the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health. Additionally, four unnamed companies in the U.S. and South Korea were targeted. The scope of the attacks extended to networks operated by hospitals, telecommunications providers, power companies, financial institutions, and defense contractors.
The hacking platforms were operated by a Chinese state-sponsored group known as 'QTFY,' according to an affidavit filed by the Justice Department. QTFY's paying customers include China's civilian intelligence agency, its Ministry of State Security, and China's People’s Liberation Army.
Prosecutors indicated that the group had been working to breach U.S. critical infrastructure and sensitive federal agencies since at least 2018. This long-running operation highlights the increasing sophistication of hacking groups seeking access to sensitive networks and their methods for concealing their origin.
QScan enabled customers to scan for and automatically infect thousands of Internet of Things (IoT) devices, such as smart TVs, speakers, security cameras, and smart refrigerators. These infected devices were then added to QTRouter, which served as an obfuscation network, allowing QTFY and its associated hackers to conceal their origins in China.
"State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted," Attorney General Todd Blanche said in a press release. "Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China."
The FBI stated its continued commitment to countering nation-state cyber actors. "Through complex investigations, aggressive technical operations, and strong partnerships, FBI San Diego will continue to identify, disrupt, and impose costs on our cyber adversaries," said Special Agent in Charge Mark Remily of the FBI San Diego Field Office. "We are committed to dismantling the tools behind these state-sponsored crimes and protecting the American people from malicious cyber activity."
The disruption comes as President Donald Trump and Chinese President Xi Jinping are scheduled for a bilateral meeting in Washington, D.C., in September. The Justice Department and the FBI have engaged in years-long efforts to combat state-sponsored hacking operations with ties to Russia and China.