DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

Summary: The U.S. Department of Justice on Friday corrected an earlier press statement, changing its description of NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate from victims of computer intrusion activity by the China-affiliated group QTFY to organizations 'among the targets of QTFY.' The affidavit describes QTFY as working for Nanjing Xinjiuwei Network Technology Co, active since 2018, using tools including the QScan vulnerability scanning and exploitation platform and the QTRouter obfuscation network, and in a 2019 case attempting to break into NASA by exploiting CVE-2019-11510 in Pulse Secure VPN.
Why it matters: The FBI has since seized the domains tied to QScan and QTRouter (qtproxy[.]xyz, qt-proxy[.]org, and qt-team[.]com), but QTFY sells access to those same tools to other actors, and Lumen Black Lotus Labs says it has industrialized ORB networks built from infected IoT devices and leased VPSs to hide the origin of its traffic.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2019-11510
Related: CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·
Threat Advisory: Pulse Secure Connect Coverage Cyber Risks ·