US and EU Disrupt Chinese State-Sponsored Hacking Network Targeting Critical Infrastructure

The United States has taken decisive action against a sophisticated Chinese state-sponsored hacking network, dismantling a global botnet and hacking platform used to target critical U.S. infrastructure. The Department of Justice and the FBI announced the seizure of domains associated with the "QScan" and "QTRouter" operations, which had infiltrated sensitive networks across various high-level agencies.

These intrusions compromised national security, health, and financial institutions, including NASA, the Federal Reserve, the Senate, the Department of Energy, the Department of Health and Human Services, the Department of Justice, and the National Institutes of Health. The operation marks a significant effort to counter indiscriminate hacking activities sponsored by the People's Republic of China.

“

State-sponsored cybercriminals who attack the critical infrastructure of the United States will be stopped and prosecuted. We are here to ensure the safety of the American people and will use all the tools at our disposal to fulfill that promise.

U.S. Attorney Todd Blanche emphasized the government's commitment to protecting American citizens, stating, "State-sponsored cybercriminals who attack the critical infrastructure of the United States will be stopped and prosecuted." He assured that all available tools would be used to fulfill this promise. FBI Director Kash Patel highlighted the dismantling of the global botnet and hacking platform as a key technical operation to disrupt China's cyberespionage efforts.

Court documents reveal that the entity behind these operations, QTFY, offered paid hacking services to clients including China's Ministry of State Security and the People's Liberation Army. Their services, QScan and QTRouter, automatically scanned and infected thousands of Internet of Things (IoT) devices worldwide. These compromised devices, along with commercial proxy devices and rented virtual private servers, formed the QTRouter network. This obfuscation network allowed QTFY and its clients to mask the Chinese origin of their cyber intrusions, making malicious communications appear to originate from outside China.

“

Today, we announce the dismantling of a global botnet and hacking platform used by state-sponsored Chinese cybercriminals to attack the critical infrastructure of the United States.