FBI seizes China-linked QScan and QTRouter platforms used to target US critical infrastructure

The FBI and the U.S. Department of Justice have seized two platforms, QScan and QTRouter, which were used by a China-linked group to conceal cyberattacks and target U.S. critical infrastructure, according to Security Affairs.

The platforms, operated by a China-based group identified as QTFY and linked to Nanjing Xinjiuwei Network Technology Company, provided hacking services to entities including China's Ministry of State Security. QScan was used to scan the internet for vulnerable devices, infecting thousands of Internet of Things (IoT) devices. These compromised devices, along with commercial proxy services and rented servers, formed the QTRouter network. QTRouter acted as an obfuscation network, routing malicious traffic through systems outside China, making attribution and blocking efforts significantly more difficult for authorities. Targeted entities included NASA, the Federal Reserve, and several U.S. government departments.

The seizure disrupted the group's ability to manage its infrastructure, making the malware platforms inoperable. This action is part of a broader effort by the FBI to disrupt indiscriminate hacking activities by the People's Republic of China, following previous actions against similar China-linked botnets.

Source: Security Affairs