US Says Chinese Hackers Broke Into NASA, Senate In Big Security Breach

US law enforcement said it has seized internet domains allegedly used by Chinese state-sponsored hackers to target critical American infrastructure. Using the seized platforms, the Chinese hacker groups were able to break into NASA, the Federal Reserve, the National Institutes of Health, and the US Senate, the Justice Department said in a statement. 

The Justice Department and FBI said the seized hacking platforms known as "QScan" and "QTRouter" were used by a hacking group known as "QTFY." Court documents showed that QTFY offers computer hacking services to paying customers, including the Chinese Ministry of State Security and the People's Liberation Army.

According to the Justice Department, QTFY was employed by Nanjing Xinjiuwei Network Technology Company, a China-based technology company.

Victims of QTFY computer intrusion activity included NASA (National Aeronautics and Space Administration), the Federal Reserve, the US Senate, and the departments of energy, justice, and health and human services, the agency said.

These hackers also allegedly targeted private sector infrastructure, including hospitals, universities, telecom providers, power companies, financial institutions, and defence contractors.

"Federal law enforcement investigated and disabled the PRC's malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People's Republic of China," Attorney General Todd Blanche said in a statement.

"We are here to ensure security for the American people and will use every tool we have to keep that promise," he added

How Chinese Hackers Worked

According to the court documents, QScan searched for and automatically infected thousands of internet-connected devices around the world.

Those devices were then incorporated into QTRouter, a network controlled by the hacking group. The network also used commercial proxy services and leased virtual private servers.

The platform enabled hackers to conceal the Chinese origin of their activities, the department said.

Malicious communications appeared to originate from compromised computers located outside China and, in some cases, near the targeted network.

The seized domains had been built into both malware platforms and were required for communication, authentication and other essential functions.

Taking control of those domains rendered QScan and QTRouter inoperable, according to the department.

FBI Director Kash Patel said the operation resulted in the disruption of a "global botnet and hacking platform used by Chinese state-sponsored hackers to target US critical infrastructure."

The FBI and National Security Agency also issued a cybersecurity advisory containing indicators that could help organisations detect possible QTFY activity.