Global Markets
Home›Global Markets›North America›DOJ and FBI seize domains tied to QTFY malware platfor…
DOJ and FBI seize domains tied to QTFY malware platforms
Court filings say the seized domains were hard coded into QScan and QTRouter, disabling tools used to access U.S. networks including the Federal Reserve and DOJ.
The U.S. Department of Justice and the FBI seized internet domains they say are hard coded into malware platforms allegedly run by the Chinese state sponsored hacking group QTFY, court documents unsealed Wednesday in the Southern District of California show. The action was described as an effort to dismantle foreign sponsored hacking campaigns targeting U.S. critical infrastructure and major federal agencies.
HousingWire reports that the malware tools, known as QScan and QTRouter, were allegedly used to access government networks including the Federal Reserve, the DOJ, and the U.S. Senate, with additional alleged targets including NASA, the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health.
According to the DOJ, prosecutors believe the platforms are operated by a group called QTFY employed by Nanjing Xinjiuwei Network Technology Company in China. The DOJ also alleges QTFY offers paid hacking services to customers including the PRC Ministry of State Security and the People’s Liberation Army.
DOJ and FBI officials said QScan scans and automatically infects thousands of internet of things devices, which are then pulled into QTRouter, described as an obfuscation network that can disguise the origin of attacks by routing traffic through compromised systems worldwide. The DOJ said the seized domains were essential for communication and authentication, making the tools inoperable once seized, and Attorney General Todd Blanche said the operation aims to stop and prosecute state sponsored malicious hackers targeting U.S. infrastructure.