The FBI has announced a significant operation targeting a network of Chinese state-sponsored proxy devices utilized by a hacking group, identified as QTFY, which is allegedly affiliated with Nanjing Xinjiuwei Network Technology Company. This marks a substantial escalation in the investigation into the group’s extensive reach and activities, revealing a decades-long campaign targeting American government agencies and critical infrastructure.
On Wednesday, the Department of Justice revealed the takedown of two tools, QTRouter and QScan, developed by QTFY. According to prosecutors and an FBI affidavit, the company provided its customers with access to botnets of hacked IoT devices and coopted commercial proxy services. The company’s customers, allegedly including the Ministry of State Security and the People’s Liberation Army, then used these proxy services as relay points to carry out hacking campaigns stretching back as early as 2018, according to US government reports.
The DOJ states that the hackers breached a staggering list of US victim agencies, including NASA, the US Senate, the Federal Reserve, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and the DOJ itself. The FBI affidavit details the types of US infrastructure and industries targeted via these proxy networks, including power companies, telecommunications providers, hospitals, financial institutions, and defense contractors.
Nanjing Xinjiuwei Network Technology Company could not be immediately reached for comment.
The FBI’s affidavit goes on to list types of US infrastructure and industries targeted via the proxy networks, too, including power companies, telecommunications providers, hospitals, financial institutions, and defense contractors—though it does not confirm which of the targeted entities were successfully breached or to what degree.
“The scale is really giant,” says Damon Rouse, a threat intelligence researcher at Lumen Technology’s Black Lotus Labs, which worked with the FBI and DOJ on the takedown operation. In a blog post about the operation, Black Lotus Labs describes the Nanjing-based company as a ‘quartermaster’ for China’s hacking operations, one of several private contractors that increasingly provide key tools and infrastructure to China’s state-sponsored hackers.
“This is a very long lasting campaign,” Rouse says, “and this company and these people involved in it have very close ties to the highest levels of the People’s Liberation Army.”
The FBI’s affidavit details the group’s transition to hijacking virtual private network (VPN) services typically used by Chinese citizens to route around China’s Great Firewall censorship system. Proxying Chinese hacking operations through those VPNs created a layer of obfuscation that mixed malicious traffic with benign traffic of Chinese users seeking to access the open internet. “It made it difficult for us to see the bad, state-sponsored traffic because there was so much typical user VPN traffic in the nodes they were coopting,” Rouse says.
The FBI and Justice Department say they’ve now disrupted the group’s proxy infrastructure by seizing key domains hardcoded into QTRouter and QScan. Lumen, which serves as an internet backbone provider, says it also ‘null-routed’ certain domains, rendering them inoperable—including the more recent system of coopting censorship-bypassing VPNs.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” US attorney general Todd Blanche wrote in a statement, though the DOJ’s announcement didn’t appear to include charges against any individuals. “We are here to ensure security for the American people and will use every tool we have to keep that promise.”
The FBI and Justice Department say that they’ve now disrupted the group’s proxy network by seizing key domains hardcoded into QTRouter and QScan. Lumen, which serves as an internet backbone provider, says it also ‘null-routed’ certain domains, rendering them inoperable—including the more recent system of coopting censorship-bypassing VPNs.”
Rouse says that the hacking campaigns don’t appear to overlap with China’s Volt Typhoon hacking campaign, which has sought to gain the capability to disrupt US power, water, and other military and civilian infrastructure. Instead, he says, the years-long hacking operations appeared—at least within Lumen’s visibility—to be focused on more traditional espionage. “It was pretty much as broad as you can get, mapping back to what Chinese cyber operations are tasked with in terms of information collection,” Rouse says.
The disruption of the QTFY proxy network will create a setback for those hacking campaigns and some embarrassment and customer relations problems for the Nanjing Xinjiuwei Network Technology Company, Rouse says. But given the hackers’ flexibility in shifting its methods over the years to find new ways to relay and disguise malicious traffic, he has no doubt that it will adapt and return.
Watch Related Video
Source: Wired
