FBI says Chinese hacking group targeted US government agencies for years
The Justice Department and FBI said a Chinese government-backed hacking group has for years targeted hundreds of U.S. entities, including NASA, the National Institutes of Health, the Department of Health and Human Services, the Justice Department, Department of Energy, U.S. Senate and Federal Reserve.
According to a DOJ statement and an affidavit unsealed Wednesday in federal court in California, the group, known as “QTFY” and including former Chinese military members, has used its infrastructure to compromise critical infrastructure since 2018, targeting government agencies, hospitals, telecommunications providers, power companies and defense contractors.
Prosecutors seized three internet domains affiliated with the Chinese company Nanjing Xinjiuwei Network Technology Company and issued advisories to companies and federal agencies to help potential victims protect against future attacks.
The seizure warrant says QTFY hackers “conducted computer intrusions” in September 2024 at three Energy Department laboratories, NIH, an HHS agency and an unnamed U.S. security device manufacturer. The group also allegedly attempted to hack NASA in 2019, though court documents do not indicate the effort succeeded.
The documents do not clearly state the scale of attacks against other government agencies identified as victims or the group’s success infiltrating specific networks.
The FBI and National Security Agency released an advisory with indicators of QTFY activity, while Lumen Technologies’ threat intelligence group, Black Lotus Labs, published details of QTFY’s tactics, techniques and procedures to help prevent future attacks.
