US says Chinese-linked hackers attacked NASA, Senate, and gov’t agencies

The United States said it has disrupted a China-affiliated hacking operation that targeted sensitive US government bodies, including the US Department of Justice, NASA, the Federal Reserve, and the US Senate.

The Justice Department’s announcement, released on Wednesday, said the operation took down two hacking platforms, QScan and QTRouter, that were used to break into internet-connected devices and hide the source of attacks. The infrastructure had been used to compromise critical infrastructure and other sensitive networks in the US and elsewhere since at least 2018, according to an affidavit.

list of 3 items

list 1 of 3How are companies, governments responding to the OpenAI hack?
list 2 of 3US authorities probe cyberattack on water systems in Minnesota
list 3 of 3Michigan joins Minnesota in reporting cyberattacks, with FBI investigating

end of list

Hackers had unsuccessfully attempted to access NASA networks in August 2019. In September 2024, they successfully breached networks at three Department of Energy laboratories, NIH, HHS, and a US security-device manufacturer, according to court documents.

The Federal Reserve, US Senate, and four unnamed companies in the US and South Korea were also identified as targets.

The Justice Department said the platforms were run by a China-based firm, the Nanjing Xinjiuwei Network Technology Company, whose clients it said included China’s civilian intelligence agency, the Ministry of State Security, and its military, the People’s Liberation Army.

Neither the Chinese embassy in Washington nor Nanjing Xinjiuwei responded to requests for comment by the Reuters news agency.

According to the announcement, QScan was used to find and infect thousands of internet-connected devices, including routers and other network equipment. Those devices were then incorporated into a network through QTRouter.

That network allowed the hackers to route their attacks through computers and other devices outside China. As a result, an attack aimed at a US target could appear to be coming from a device in another country, or even from a device close to the intended victim.

The latest operation does not mean all the group’s activity has been eliminated, but the domain seizures will disrupt access to the platforms.

“When an intrusion appears to come from a device down the street from the target instead of from overseas, it buys the operator time and makes attribution slow,” Richard Hummel, a vice president at cybersecurity company SecurityScorecard, told Al Jazeera. “Taking two platforms of that size offline costs the operators real capability they were using every day.”

The operation is part of a broader series of court-authorised actions targeting what Attorney General Todd Blanche described as “indiscriminate hacking activities” sponsored by China. The FBI’s Cyber Division, federal prosecutors in California, and the San Diego field office led this investigation.

Chinese-linked hacking campaigns have compromised a string of sensitive US government and private networks in recent years. In March, the FBI notified the US Congress that hackers had penetrated certain agency networks related to people under FBI investigation, with public reporting later attributing the compromise to China. Chinese-linked hackers have also been tied to a compromise of certain US House of Representatives committee networks, as well as multiple major telecommunications companies in recent years.

Al Jazeera – Breaking News, World News and Video from Al Jazeera wp:paragraph