Chinese state-linked hackers stole sensitive data from more than 300 organizations, including U.S. defense contractors, financial institutions and universities, and breached three Energy Department laboratories, the NIH and an HHS agency before the FBI knocked their hacking platforms offline this week, newly unsealed court records show.
The group, known as QTFY, operated through a China-based company that the FBI says sold hacking services to clients including China’s Ministry of State Security and People’s Liberation Army. Former PLA members worked for the company and used military relationships to secure contracts and subcontracts for offensive cyber operations, according to an FBI affidavit.
QTFY paired mass internet scanning with a network of compromised routers, cameras and other internet-connected devices that helped disguise the origin of its attacks.
FBI SAYS RUSSIAN HACKERS HIJACKED OLD WI-FI ROUTERS
By routing malicious traffic through devices near a victim’s network, the hackers could make attacks blend in with legitimate local traffic and become harder to trace, federal officials said.
The Justice Department and FBI seized three domains Wednesday that powered QTFY’s two main platforms: QScan, which hunted for vulnerable systems, and QTRouter, which masked hackers’ identities by routing their traffic through compromised devices.
Federal authorities said the seizures crippled both platforms by cutting off domains used for core communications and authentication.
The scale was massive.
AI IS NOW POWERING CYBERATTACKS, MICROSOFT WARNS
On a single day in 2024, QScan processed more than 2 million scanning and penetration-testing tasks, according to the FBI affidavit. The platform contained more than 200 proof-of-concept exploits and searched the internet for vulnerable software, exposed services and other openings hackers could exploit.
"QTFY is another example of how China’s cyber ecosystem has blurred the line between commercial cybersecurity and state-sponsored operations," Aaron Shraberg, senior intelligence team lead at Flashpoint, told Fox News Digital. "The commercialization of that ecosystem has helped turn capabilities that once relied on bespoke tradecraft into tools and services that can be developed, reused and deployed at scale."
Federal authorities said QTFY targeted NASA, the Justice Department, the Federal Reserve and Senate systems, along with power companies, hospitals, telecommunications providers, defense contractors and election infrastructure.
Fox News Digital has reached out to the Chinese embassy for comment.
But not every attack worked.
In 2019, QTFY tried to break into NASA using a vulnerability in the agency’s virtual private network. The attempt failed because NASA had already patched the flaw, according to the affidavit.
A separate FBI, NSA and Cyber National Mission Force advisory said the group scanned Senate and hospital-system networks in March and a U.S. election system in June but failed to gain access.
Other attacks succeeded.
In May 2024, QTFY exploited a recently disclosed Check Point vulnerability while scanning U.S. power and telecommunications companies and stole data from more than 300 organizations in the United States and abroad, according to the advisory.
The government did not name the affected organizations or describe what information was taken. The advisory said victims included U.S. defense contractors, financial institutions and universities.
Four months later, hackers exploited zero-day flaws in Ivanti Cloud Services Appliance software to gain access to three Department of Energy national laboratories, the National Institutes of Health, the Health Resources and Services Administration and a U.S. security-device manufacturer, the advisory said.
FBI BRINGS ALLEGED CHINA-LINKED HACKER TO US IN RARE EXTRADITION AS PATEL DEFENDS ITALY TRIP
The advisory did not disclose what information was accessed, how long the hackers remained inside the networks or whether the breaches disrupted operations.
"State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted," Attorney General Todd Blanche said in a statement announcing the seizures.
The takedown adds to a string of FBI operations aimed at dismantling infrastructure used by Chinese government-linked hacking groups.
In 2023, the FBI disrupted a botnet used by Volt Typhoon, a China-linked group accused of concealing its access to U.S. and foreign critical infrastructure.
SIGN UP TO GET THE POLITICS NEWSLETTER
The following year, the bureau disabled a botnet made up of hundreds of thousands of infected internet-connected devices that federal officials said Flax Typhoon supplied to Chinese government customers.
Last year, the FBI said it removed PlugX surveillance malware from more than 4,000 U.S. computers infected by Mustang Panda, another China-linked hacking group.