DOJ: US Seizes QScan QTRouter Domains, Disrupting China Cyberattacks

• The U.S. Department of Justice seized two internet domains, QScan and QTRouter, used by the Chinese state-sponsored hacking group QTFY.
• These domains facilitated cyberattacks targeting U.S. critical infrastructure and sensitive government networks, including NASA and the Federal Reserve.
• QTFY, reportedly employed by Nanjing Xinjiuwei Network Technology Company, used QScan to infect devices and QTRouter to form a botnet that obscured its activities.
• The seizure, authorized by a San Diego federal judge, rendered the platforms inoperable and is part of ongoing U.S. efforts against state-sponsored cyber threats.
• Officials described the action as a victory in the 'cyber cold war,' with the Attorney General vowing to prosecute hackers preying on American infrastructure.

State-sponsored malicious hackers preying on America’s critical infrastructure will be apprehended and prosecuted.

The U.S. Department of Justice (DOJ) recently announced the seizure of two internet domains, QScan and QTRouter, which were reportedly utilized by a Chinese state-sponsored hacking group known as QTFY. This decisive action, authorized by a San Diego federal judge through a court order, aimed to deny malicious actors access to platforms employed for cyberattacks targeting critical infrastructure and sensitive networks within the United States. The seizure effectively rendered these vital technological components inoperable, marking a significant step in ongoing cybersecurity efforts.

An affidavit from an FBI agent provided crucial support for the domain seizures, detailing how QTFY developed and leveraged these platforms to scan for vulnerable devices and conceal illicit network traffic. FBI Director Kash Patel underscored the importance of this operation, stating that these tools were specifically used by cyber actors from the People's Republic of China to obscure the origins of their attacks. The DOJ has framed this as the latest triumph in a series of technical operations designed to counteract China's state-sponsored hacking activities.

Further emphasizing the commitment to national security, the Special Agent in Charge of the FBI San Diego Field Office, Mark Remily, affirmed the bureau's dedication to identifying, disrupting, and imposing costs on cyber adversaries through complex investigations, aggressive technical operations, and robust partnerships. The affidavit also indicated probable cause to believe the seized domains were involved in a money laundering scheme, adding another layer to the legal justification for the intervention. This action highlights the aggressive US government efforts against state-sponsored cyber threats, particularly those targeting critical infrastructure.

The QTFY Chinese state-sponsored hacking group has been actively compromising U.S. critical infrastructure since at least 2018, according to the FBI. Their sophisticated operations involved spying on various government agencies, including NASA, the Federal Reserve, the Department of Energy, the DOJ itself, and the Senate. The group's methodology relied heavily on the QScan and QTRouter platforms, which formed a dangerous botnet critical infrastructure threat.

QScan's primary function was to automatically scan and infect thousands of vulnerable devices across the globe. Once compromised, these devices were integrated into the QTRouter network, forming a vast network of infected machines, or 'bots.' These bots could then be remotely controlled by QTFY for a multitude of tasks, including obscuring the group's actions and their Chinese origin. Notably, some of these compromised devices were even found within the targeted networks, such as government employee computers, providing an insidious foothold for the attackers.

The DOJ has identified QTFY as being employed by the Nanjing Xinjiuwei Network Technology Company. A government advisory, corroborated by a report from Lumen Technologies, further revealed that QTFY operated under a 'quartermaster model,' providing the necessary infrastructure to identify targets, route malicious traffic, and mask its activities. The group offered these platforms as branded services to various clients, including the Chinese military and China's Ministry of State Security, underscoring the state-backed nature and strategic intent behind these cyber operations.

Officials from the Trump administration characterized the domain seizures as a significant victory in what is frequently described as a 'cyber cold war' between the United States and China. Attorney General Todd Blanche issued a strong statement, asserting that state-sponsored malicious hackers preying on America’s critical infrastructure will be apprehended and prosecuted. He reiterated the government's commitment to ensuring the security of the American people, pledging to utilize every available tool to uphold this promise.

Federal law enforcement agencies have been instrumental in investigating and disabling the People's Republic of China's malicious software, with this recent action being part of a broader series of technical operations aimed at dismantling indiscriminate hacking activities sponsored by the PRC. FBI Director Kash Patel also highlighted that this operation aligns with President Trump’s Cyber Strategy for America, emphasizing the FBI's intensified efforts to influence adversary behavior and defend the homeland in cyberspace. This ongoing campaign of DOJ domain seizure cybersecurity actions reflects a proactive stance against evolving digital threats.

This incident serves as a critical reminder for compliance officers and legal counsel, particularly those within entities operating in critical sectors. It underscores the imperative to review existing cybersecurity protocols and enhance threat intelligence capabilities to identify indicators related to QTFY, QScan, and QTRouter. Proactive measures are essential to mitigate potential vulnerabilities and ensure compliance with the rapidly evolving landscape of cybersecurity mandates.

This action underscores the aggressive US government efforts against state-sponsored cyber threats targeting critical infrastructure. Compliance officers and legal counsel for entities in critical sectors should review their cybersecurity protocols and threat intelligence for indicators related to QTFY, QScan, and QTRouter to mitigate potential vulnerabilities and ensure compliance with evolving cybersecurity mandates.

Source: Original reporting via Courthouse News