The US government announced on Wednesday that it has disrupted a hacking platform and botnet used by Chinese threat actors in attacks aimed at military and critical infrastructure systems.
According to the Justice Department, the disruption efforts targeted a state-sponsored group called QTFY, which has been operating from a company called Nanjing Xinjiuwei Network Technology.
QTFY has offered its hacking services to the Chinese government and others, enabling attacks against many critical systems in the United States since its establishment in 2018.
Disruption of QTFY hacking platform
The US government has targeted two hacking services offered by QTFY: the scanning and exploitation platform QScan, and the obfuscation network QTRouter.
QScan is designed to scan the internet for vulnerable IoT devices and ensnare them in the QTRouter botnet, enabling threat actors to abuse the compromised devices to conceal their malicious activities and evade detection.
US authorities identified and seized domains used by QScan and QTRouter.
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable,” explained the Justice Department.