US says Chinese hackers broke into DOJ, NASA, Federal Reserve, Senate

US notes Chinese hackers broke into DOJ, NASA, Federal Reserve, Senate The Justice Department unveiled it ‌has disrupted a Chinese hacking operation responsible for break-ins at numerous sensitive US federal agencies.

Key points

• According to court documents, QTFY offers computer hacking services to its paying customers, including China's Ministry of State Security and People's Liberation Army.
• In backing of President Donald Trump's Cyber Strategy for America, Patel stated, "the FBI is surging efforts to shape adversary behavior and defend the homeland in cyberspace."
• This person until January 2025 was the Pentagon's top civilian overseeing U.S.
• Microsoft cautioned in May 2023 that it had uncovered "stealthy and targeted malicious activity" by a state- hacking group known as Volt Typhoon that was targeting U.S.
• The Justice Department notes a Chinese hacking operation was responsible for break-ins at the DOJ, NASA, the Federal Reserve, the Senate and other sensitive U.S.

For context, the Justice Department notes a Chinese hacking operation was responsible for break-ins at the DOJ, NASA, the Federal Reserve, the Senate and other sensitive U.S. Administration agencies.

WASHINGTON – U.S. Authorities stated Aug. 26 that it ‌has disrupted a Chinese hacking operation that it believes is responsible for cyber break-ins at the departments of Justice and Energy as well as NASA, the ⁠Federal Reserve, the Senate and other sensitive U.S. Administration agencies.

In an official note, the Justice Department confirmed that it has seized internet domains employed by two hacking ‌platforms, ⁠dubbed "QScan" and "QTRouter, " which it noted were employed in the penetration campaign by the Beijing administration.

As described in court documents unsealed in the Southern District of California, hackers from a People's Republic of China state- group known as "QTFY, " employed by China-based Nanjing Xinjiuwei Network Technology Firm, allegedly "created and operated" the two hacking platforms and employed them to burrow into U.S. Target networks and then cover their tracks.

Among the victims of QTFY's computer intrusion activity, the Justice Department documents alleged, are the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health and the U.S. Senate.

In an official note to USA TODAY, the Chinese embassy in Washington remarked Beijing "firmly opposes and combats all forms of cyberattacks in accordance with the law. We urge the US side to stop using cybersecurity problems to smear or discredit China."

In practice, the embassy additionally stated China "will firmly safeguard the legitimate rights and interests of Chinese companies" in response to any U.S. Efforts to impose punitive restrictions on them based on accusations of hacking.

"State- malicious hackers preying on America's critical infrastructure will be halted and prosecuted. We are here to ensure security for the American individuals and will apply every tool we have to keep that promise, " Attorney General Todd Blanche noted in an official note.

Blanche remarked federal law enforcement "investigated and disabled the PRC's malicious software, " in the latest in a series of technical operations to dismantle "indiscriminate hacking activities by the People's Republic of China."

FBI Director Kash Patel remarked the bureau was central in the disruption of "a global botnet and hacking platform used by Chinese state- hackers to target U.S. Critical infrastructure."

U.S. Authorities did not comment on the potential damage done by the cyber-spying effort and how long it was going on before being disrupted. Such damage assessments are traditionally deemed classified and not shared publicly due to security reservations.

According to court documents, QTFY offers computer hacking services to its paying customers, including China's Ministry of State Security and People's Liberation Army. It has one of the world's most formidable hacking capabilities.

Michael Lebowitz, a former senior attorney in DOJ's National Security Division, informed USA TODAY the decision to publicize the alleged Chinese hacking scheme "looks to me like a 'name-and-shame' campaign where the U.S. Essentially publicly calls out foreign hackers to let them know that we're on to them."

"The U.S. Often takes similar tactics when indicting foreign hackers" since it's unlikely those hackers would ever be brought to trial in the U.S., stated Lebowitz. This person is additionally a former senior legal adviser to U.S. Army Cyber Command.

QTFY's computer hacking services work together, with QScan scanning and automatically infecting thousands of "internet-of-things" (IoT) devices worldwide, the court documents allege. Those devices are then continued to the QTRouter network of QTFY-controlled devices, with QTRouter additionally serving as an "obfuscation network" to conceal the Chinese government-linked origin of their computer intrusion activities.

Notably, the court-authorized seizures confirmed Aug. 26 created QScan and QTRouter inoperable, according to the court documents. 'Pervasive' and 'particularly sophisticated' hacking operations by China.

"China's hacking activities are so pervasive, and they're able to operate at a scale that particularly few other countries worldwide can match. And they're particularly sophisticated, " stated Mieke Eoyang, a former deputy assistant secretary of Defense for Cyber Policy and now a visiting professor at Carnegie Mellon University in Pittsburgh. "But the U.S. Is also very sophisticated, and we've seen over the past five to 10 years a real increase in focus by the Department of Justice and FBI on being able to go after these types of cyberattacks."

Such Chinese attacks – and U.S. Disruptions – have become a virtually routine cat-and-mouse game as Beijing has successfully penetrated U.S. Critical infrastructure over the past decade, including financial institutions and power plants.

Notably, the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, part of the Department of Homeland Security, has designated 16 critical infrastructure sectors whose assets, systems and networks – whether physical or virtual – are considered so vital that their incapacitation or destruction would have a debilitating effect on U.S. Physical and economic security, including national public health and safety.

Microsoft cautioned in May 2023 that it had uncovered "stealthy and targeted malicious activity" by a state- hacking group known as Volt Typhoon that was targeting U.S. Critical infrastructure organizations.

That Volt Typhoon campaign, one of plenty of sustained Chinese hacking efforts, focused on espionage and information gathering, Microsoft stated, and was "pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and the Asia region during future crises." Using cybercriminals to support camouflage China's malicious internet activity.

For context, the new DOJ announcement is significant since it acknowledges China's apply of cybercriminals to support camouflage its malicious activity on the internet, even as the Trump administration is enlisting the private sector to combat such activity, remarked Eoyang. This person until January 2025 was the Pentagon's top civilian overseeing U.S. Military offensive cyber operations.

"We've long known that China has this ecosystem that's not just the government but involves the commercial side, too, of people selling services to their state security apparatus, " Eoyang informed USA TODAY. "What's interesting is that the Trump administration recently is taking steps to move in that direction by authorizing private U.S. Companies to engage in this type of behavior."

President Donald Trump signed a national security memorandum on Aug. 12 titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime" that authorizes vetted private U.S. Firms to conduct offensive cyber operations against foreign criminal groups under federal supervision.

"I think the jury's still out on whether or not this is a good thing" for the U.S. To do in response to pervasive hacking efforts by China, Russia, Iran and other administration and nonstate entities, Eoyang stated.

"It certainly makes it harder to call out China for this particular type of bad behavior when the U.S. Authorizes it itself, " she remarked. "But it's also an admission that the volume of this type of activity happening on the internet is bigger than government's ability to get after it itself."

Lebowitz remarked the Chinese administration has been increasingly effective in sneaking malware and nefarious cyber tools into U.S. Systems, especially since it has begun using "niche hacking services that add an extra layer of secrecy and obfuscation that makes detecting those threats so much harder."

"It's now a cat and mouse game to detect these threats before they can cause significant damage, " he remarked.

And while Washington is using a whole-of-government approach to detecting Beijing's hacks, including forensic, intelligence and legal tools, the latest disruption, Lebowitz remarked, "is likely just the tip of the iceberg in terms of existing threats." Share your feedback to assist improve our site!

For now, US says Chinese hackers broke into DOJ, NASA, Federal Reserve, Senate remains the part of the story worth watching, and further updates are likely as more details are confirmed.