FBI says Chinese hacking group targeted government agencies, hospitals and military

NASA, NIH, HHS, DOJ were among hundreds of entities targeted, the FBI said.

The Justice Department and FBI said a Chinese government-backed hacking group has for years engaged in targeted attacks against hundreds of entities in the United States including NASA, National Institutes of Health, the Department of Health and Human Services, the Justice Department, the Department of Energy, the U.S. Senate and the Federal Reserve.

According to a DOJ statement and an affidavit unsealed Wednesday in federal court in California, a group known as "QTFY" -- which includes former members of China's military -- has used its infrastructure to compromise critical infrastructure since 2018 in networks spanning from government agencies, hospitals, telecommunications providers, power companies and defense contractors.

As part of their efforts to expose and disrupt the group, prosecutors successfully seized three internet domains affiliated with the Chinese company, Nanjing Xinjiuwei Network Technology Company, and multiple advisories have been issued to companies and other federal agencies so that potential victims of the group can better protect themselves from future attack.

In the seizure warrant, prosecutors say that in September 2024, QTFY hackers "conducted computer intrusions" at three Energy Department laboratories, NIH, an HHS agency as well as an unnamed U.S. security device manufacturer. The group is further alleged to have attempted a hack against NASA in 2019, though court documents do not suggest that the effort was successful.

The court documents do not state clearly the scale of the attacks against several of the other government agencies identified as victims or the group's level of success in infiltrating specific networks.

"Today’s announcement demonstrates the Justice Department’s steadfast commitment to going on the offensive against cyber threats to the national security,” said Assistant Attorney General for National Security John Eisenberg in a statement announcing the seizures. "These court-authorized seizures deny PRC-linked hackers access to tools they use to mount online attacks against our Nation’s critical infrastructure."

The FBI and National Security Agency released an advisory with indicators of QTFY activity. Also, Lumen Technologies' threat intelligence group, Black Lotus Labs, published a description of QTFY’s tactics, techniques and procedures to help thwart future hacks.

Sponsored Content by Taboola