China-linked hackers infiltrated US government networks before FBI takedown

The group, known as QTFY, operated through a China-based company that the FBI says sold hacking services to clients including China's Ministry of State Security and People's Liberation Army. Former PLA members worked for the company and used military relationships to secure contracts and subcontracts for offensive cyber operations, according to an FBI affidavit.

QTFY paired mass internet scanning with a network of compromised routers, cameras and other internet-connected devices that helped disguise the origin of its attacks.

By routing malicious traffic through devices near a victim's network, the hackers could make attacks blend in with legitimate local traffic and become harder to trace, federal officials said.

Federal authorities said the seizures crippled both platforms by cutting off domains used for core communications and authentication.

The scale was massive.

On a single day in 2024, QScan processed more than 2 million scanning and penetration-testing tasks, according to the FBI affidavit. The platform contained more than 200 proof-of-concept exploits and searched the internet for vulnerable software, exposed services and other openings hackers could exploit.

"QTFY is another example of how China's cyber ecosystem has blurred the line between commercial cybersecurity and state-sponsored operations," Aaron Shraberg, senior intelligence team lead at Flashpoint, told Fox News Digital. "The commercialization of that ecosystem has helped turn capabilities that once relied on bespoke tradecraft into tools and services that can be developed, reused and deployed at scale."

Fox News Digital has reached out to the Chinese embassy for comment.

But not every attack worked.

In 2019, QTFY tried to break into NASA using a vulnerability in the agency's virtual private network. The attempt failed because NASA had already patched the flaw, according to the affidavit.

A separate FBI, NSA and Cyber National Mission Force advisory said the group scanned Senate and hospital-system networks in March and a U.S. election system in June but failed to gain access.

Other attacks succeeded.

In May 2024, QTFY exploited a recently disclosed Check Point vulnerability while scanning U.S. power and telecommunications companies and stole data from more than 300 organizations in the United States and abroad, according to the advisory.

The government did not name the affected organizations or describe what information was taken. The advisory said victims included U.S. defense contractors, financial institutions and universities.

Four months later, hackers exploited zero-day flaws in Ivanti Cloud Services Appliance software to gain access to three Department of Energy national laboratories, the National Institutes of Health, the Health Resources and Services Administration and a U.S. security-device manufacturer, the advisory said.

The advisory did not disclose what information was accessed, how long the hackers remained inside the networks or whether the breaches disrupted operations.

"State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted," Attorney General Todd Blanche said in a statement announcing the seizures.

The takedown adds to a string of FBI operations aimed at dismantling infrastructure used by Chinese government-linked hacking groups.

The following year, the bureau disabled a botnet made up of hundreds of thousands of infected internet-connected devices that federal officials said Flax Typhoon supplied to Chinese government customers.