FBI Seizes Hacking Tools It Says China Used to Attack NASA, DOE, US Senate and Critical Networks
Arthur T Knackerbracket writes:
UPDATE After publication, the US Justice Department walked back its earlier claims that multiple US government agencies were hacked by Beijing's cyberspies. In an updated press release, the feds removed "victims," and now says NASA, the Federal Reserve, departments of Energy, Justice, and Health and Human Services, along with the National Institutes of Health, and the US Senate were "targets."
The FBI on Wednesday said it disrupted a botnet and seized two platforms that Chinese-government cyberoperatives used to hack NASA, the US Senate, the Department of Energy, and several other government agencies and critical networks.
The Federal Reserve, Department of Justice, Department of Health and Human Services, and the National Institutes of Health were also among those victimized by the two now-seized hacking tools: a vulnerability scanning and exploitation malware named QScan, and an obfuscation network named QTRouter.
The FBI says a People's Republic (PRC) of China-backed group called QTFY created and operated the two platforms, plus botnets of compromised IoT devices. The Bureau says QTFY's hackers work for a private PRC company called Nanjing Xinjiuwei.
[...] QScan scans and automatically infects thousands of IoT devices worldwide, and then adds them to the QTRouter network of QTFY-controlled devices.
The QTRouter botnet - consisting of these compromised IoT devices, plus commercial proxy service devices, and leased virtual private servers- then serves as an obfuscation network, allowing QTFY and other criminals who pay for the service to conceal the origin of their digital intrusion activities, making these communications appear to originate from local computers.
On Monday, a US federal court granted seizure warrants for three domains linked to QTFY: qtproxy.xyz, qt-proxy.org, and qt-team.com. All three domains were hardcoded into both the QScan and QTRouter malware, and the court-authorized seizures made both hacking services inoperable, the Justice Department said.
The hacking services and malware have been in use since at least 2018, and as recently as this year when QTFY infrastructure compromised the US Senate, according to court documents.
Read more of this story at SoylentNews.