FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks

On Wednesday, the FBI announced it had taken action against a sophisticated hacking operation using Chinese-government cyber operatives. They seized two platforms and disrupted a botnet used to target critical networks, including NASA, the US Senate, the Department of Energy, and several other government agencies.

The hacking tools, QScan and QTRouter, were created and operated by a Chinese-backed group called QTFY, which works for a private Chinese company called Nanjing Xinjiuwei. The FBI believes QTFY's hackers are former members of the People's Liberation Army (PLA) and use their connections to secure contracts supporting offensive cyber operations.

According to court documents, QScan scans and infects thousands of IoT devices worldwide, adding them to the QTRouter network. This botnet serves as an obfuscation network, making it difficult to trace the origin of malicious digital activities.

The hacking services have been in use since at least 2018, and were recently used to target the US Senate in 2024, according to the FBI. QTFY exploited a known vulnerability in Ivanti's Pulse Secure VPN in 2019, 2020, and 2024, as well as a flaw in Citrix VPN products. Most recently, QTFY hackers breached computers at three DOE National Laboratories, NIH, and a US security device manufacturer in 2024.

This enforcement action is part of a series of court-ordered seizures aimed at disrupting China's hacking activities over the past few years. The FBI has taken down other Chinese-sponsored malware and botnets, including those used by Mustang Panda, Flax Typhoon, and Volt Typhoon.