The U.S. Department of Justice and FBI revealed in a statement Wednesday that it had seized domains related to platforms that it claims were operated by China state-sponsored hackers. The press release says the Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, NIH, NASA, and U.S. Senate all experienced "computer intrusion activity."The Justice Department says a state-sponsored group known as QTFY is responsible for the intrusion, which the U.S. government claims came to be through two pieces of malware: QTRouter and QScan. The release says the People's Republic of China (PRC) Ministry of State Security was among QTFY's paying customers.According to the U.S. government, QScan "scans and automatically infects thousands of [IoT] devices worldwide." Those devices are then added to the QTRouter network. It's a botnet, but the Justice Department also calls it an "obfuscation layer" to mask the origin of malicious traffic. QTFY's system has been used to compromise U.S. critical infrastructure since 2018, according to the affidavit.The group is said to be employed by the Nanjing Xinjiuwei Network Technology Company, which we were unable to find any information on.As part of the action, the Justice Department seized three domains: qtproxy.xyz, qt-proxy.org, and qt-team.com. Those domains now show the seizure notice you can see below.
US Justice Department claims Chinese state-sponsored hackers infiltrated systems at NASA, Senate, Federal Reserve, and more — FBI moves forward with domain seizures
The group has apparently been operating since 2018.










