US Justice Department Reworded Its Statement: Agencies Weren't Victims of Chinese Hackers, but Targets

On Friday the US Department of Justice corrected its own press release, which had previously claimed that a number of federal agencies had fallen victim to attacks by Chinese hackers. In the updated version, those same organizations are described no longer as “victims” but as being “among the targets” of the QTFY group.

A week earlier, the list of those harmed by the “computer intrusions” had included NASA, the Federal Reserve System, the Departments of Energy, Justice and Health, the National Institutes of Health and the US Senate. In the new edition the wording has been softened: they merely appear “among the targets.” As the department explained, the changes were made so that the release would precisely match the text of the affidavit filed in support of the seizure of the domains. The change was reported by Reuters.

The difference between a “target” and a “victim” is crucial here: it means that, despite the broad scope of the attacks, only some of the organizations were actually compromised.

Who Is QTFY

According to investigators, QTFY (also known as QT AND QTCYBER) works for a private Chinese company, Nanjing Xinjiuwei Network Technology, and the payments it received from China's Ministry of State Security point to it carrying out Beijing's assignments. The group has been active since at least 2018 and has attacked not only US government networks but also hospitals, telecom operators, energy companies, financial organizations and defense contractors.

The authors of the affidavit describe QTFY as a “technical quartermaster”: the group provided reconnaissance, proxy management and routing for Chinese espionage operations. Its key tools are the QScan vulnerability scanning and exploitation platform and the QTRouter obfuscation network. In one 2019 episode, the hackers tried to break into NASA through the critical vulnerability CVE-2019-11510 in Pulse Secure VPN.

A Botnet of IoT Devices

The FBI has already taken down the domains associated with QScan and QTRouter (qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com), effectively neutralizing the malware's functionality.

According to Lumen Black Lotus Labs, the group turned the creation of Operational Relay Box (ORB) networks into an assembly line — decentralized botnets made up of infected IoT devices and rented VPSs that conceal the true source of the attacks. Access to QScan and QTRouter was also sold to third-party attackers: the infected devices became nodes of the QTRouter network. That network also includes nodes of the Chinese commercial proxy service fastlink[.]ws. This entire architecture underpins the encrypted relay network Fast Labyrinth, where malicious traffic is blended with legitimate traffic.

By routing their requests through IoT devices located near the victims, the Chinese hackers disguised themselves as ordinary users and went unnoticed while scanning and attacking critical infrastructure.

Source: The Hacker News