FBI Disrupts Chinese Proxy Tools Used in Hacking of US Agencies and Infrastructure

The FBI has disrupted a network of proxy tools used by a Chinese state-sponsored hacking group, identified as QTFY, which is allegedly linked to Nanjing Xinjiuwei Network Technology Company. The Department of Justice announced the takedown of two tools, QTRouter and QScan, which facilitated hacking campaigns against various US government institutions and critical infrastructure. The DOJ claims that the group has targeted agencies including NASA, the US Senate, and the Department of Energy since at least 2018. The FBI's affidavit indicates that the company provided access to botnets of hacked internet-of-things devices and utilized commercial proxy services for its operations. The targeted sectors included power companies, telecommunications, hospitals, and defense contractors, although the extent of successful breaches remains unspecified. Damon Rouse, a threat intelligence researcher at Lumen Technology's Black Lotus Labs, described the Nanjing-based company as a key player in China's hacking operations. The tools were designed to scan for vulnerabilities in IoT devices and manage access to botnet networks. The group had recently shifted to using virtual private networks to obscure their activities. The FBI and DOJ have seized domains associated with the proxy infrastructure, and Lumen has rendered certain domains inoperable. US Attorney General Todd Blanche emphasized the commitment to prosecuting state-sponsored hackers targeting American infrastructure. The motivations behind the hacking campaigns remain unclear, but they appear to focus on traditional espionage rather than disruptive capabilities. Experts believe that while this disruption may hinder the group's operations temporarily, they are likely to adapt and continue their activities.