US accuses Chinese state-backed hackers of targeting NASA and other agencies
The Justice Department and FBI say a Chinese state-sponsored group used hacked internet-of-things devices to hide attacks on NASA, the Federal Reserve, the Justice Department, the Senate, and other U.S. agencies since 2018.
The U.S. Justice Department and FBI have accused a Chinese state-sponsored hacking group of targeting some of America's most sensitive networks, including NASA, the Federal Reserve, the Justice Department, and the U.S. Senate. In an announcement on Aug. 26, federal officials said the group, known as QTFY, has been carrying out intrusion attempts since 2018 against a range of government agencies and private companies.
Other targets included the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health. Four unnamed companies in the United States and South Korea were also reportedly hit. Court documents describe additional targets such as hospitals, telecommunications providers, financial institutions, and defense contractors.
The operation relied on two custom tools, QScan and QTRouter, which investigators say were created and operated by QTFY, a group linked to the Nanjing Xinjiuwei Network Technology Company in China. The Justice Department alleges that the company sold hacking services to paying customers, including China's Ministry of State Security and the People's Liberation Army.
QScan was used to scan the internet for vulnerable devices and automatically infect thousands of internet-of-things devices around the world. Those compromised devices were then folded into QTRouter, an obfuscation network that also included commercial proxy devices and leased virtual private servers. Attackers routed malicious communications through this infrastructure, making their activity appear to originate from outside China or even from within the targeted network itself.
FBI Director Kash Patel said the tools were used by Chinese cyber actors to hide the origin of their attacks. The technique poses a serious challenge for security teams trying to trace an attack back to its source, because the traffic appears to come from innocent devices that have been quietly taken over.
NASA spokesperson Jennifer Dooren said the agency is committed to cybersecurity and works closely with federal partners, including the Cybersecurity and Infrastructure Security Agency, to address identified vulnerabilities. She declined to comment on specific reports for security reasons, referring questions to the Justice Department.
The Chinese Embassy in Washington denied the allegations, saying China is a firm defender of cybersecurity and opposes all forms of cyberattacks. The embassy urged the U.S. to stop using cybersecurity issues to smear China and said it would safeguard the legitimate rights of Chinese companies. China has repeatedly denied state-sponsored hacking accusations.
The case highlights the growing threat posed by internet-connected devices that are often forgotten after installation. Routers, security cameras, and other equipment that stop receiving updates can become easy entry points for hackers looking to build hidden networks. The Justice Department's action is part of a broader effort to disrupt such operations and hold state-sponsored actors accountable.
