The FBI and the Department of Justice have seized domains linked to a yearslong effort by China-nexus hackers to target U.S. critical infrastructure providers and government agencies for espionage and other activity. Authorities said a state-backed group known as QTFY operated hacking platforms known as QScan and QTRouter in an operation that went after various industries and government sites in the U.S. Among the government agencies in the crosshairs were the DOJ, the National Aeronautics and Space Administration, the Federal Reserve, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate. In addition to the federal agencies, the QTFY hackers also targeted critical infrastructure providers in the U.S., including telecom firms, hospitals, defense contractors, power companies and financial institutions, according to court records. PLA hacking ties A company called the Nanjing Xinjuwei Network Technology Company employed hackers in the state-sponsored threat group, which provided services to paying customers, including the People’s Liberation Army and China’s Ministry of State Security. QTFY used QScan to infect thousands of internet of things devices around the globe and dispatched them to the QTRouter network, which also included commercial proxy servers and virtual private servers leased by the threat actors. The origins of the malicious hacking program were hidden for years and previously could not be directly traced back to China. The National Security Agency and FBI said the QTFY hackers identified zero-day and N-day vulnerabilities to gain initial access to victim networks and then stole legitimate credentials to maintain persistence, according to an advisory released Wednesday. The hackers exploited critical vulnerabilities in a number of technology products to gain access to specific targets. - QScan was used to scan power and telecommunications firms in 2024, leveraging a Check Point Quantum Gateway vulnerability, tracked as