US says Chinese hackers broke into Justice Department, NASA, Federal Reserve, Senate
- The Chinese embassy in Washington did not immediately respond to a request for comment
The U.S. disrupted a Chinese hacking operation targeting sensitive government agencies and critical infrastructure, seizing domains used by platforms linked to China's intelligence and military.
- Specific U.S. government agencies targeted by Chinese hackers.
- Chinese firm and government entities linked to the hacking operation.
- Hacking operation's timeline and methods since 2018.
WASHINGTON: The United States said on Wednesday it had disrupted a Chinese hacking operation responsible for break-ins and attempts on the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and other sensitive government agencies.
In a statement, opens new tab, the Justice Department said it had seized domains used by two hacking platforms, dubbed QScan and QTRouter, which it said had been used as part of the campaign.
An affidavit, opens new tab identified the U.S. Department of Energy, Department of Health and Human Services, the National Institutes of Health, and four unnamed companies in the U.S. and South Korea as being among the hackers’ victims.
The Chinese embassy in Washington did not immediately respond to a request for comment. Beijing routinely denies responsibility for hacking activity.
Also read: US Treasury says Chinese hackers stole documents in ‘major incident’
The Justice Department said the platforms were run by a China-based firm, the Nanjing Xinjiuwei Network Technology Company, whose clients it said included China’s civilian intelligence agency, the Ministry of State Security, and its military, the People’s Liberation Army.
Nanjing Xinjiuwei did not immediately respond to a request for comment outside normal business hours.
HACK ATTEMPTS STARTED IN 2018
The affidavit said the hackers used tools they developed to compromise critical infrastructure and other sensitive networks in the U.S. and worldwide since at least 2018.
The level of access they gained ranged, according to the affidavit. The hackers unsuccessfully attempted to gain access to NASA networks in August 2019 by targeting a virtual private network vulnerability.
In September 2024, the hackers carried out intrusions at three unnamed Energy Department laboratories, the NIH, an unnamed HHS agency, and a U.S. security device manufacturer, according to the affidavit.
Representatives for the agencies and government organizations that the Justice Department identified as targets did not immediately respond to requests for comment.
Chinese-linked hacking campaigns have compromised a string of sensitive U.S. government and private networks in recent years. In March, the FBI notified Congress that hackers had penetrated certain agency networks related to people under FBI investigation, with public reporting later attributing the compromise to China. Chinese-linked hackers have also been tied to a compromise of certain U.S. House of Representatives committee networks, as well as multiple major telecommunications companies in recent years.
Experts who follow Chinese cyber activity say private contractors routinely carry out high-profile intrusions on behalf of various Chinese government agencies.
“Over the last decade, the number of companies offering niche offensive services has exploded,” said Dakota Cary, a China analyst with cybersecurity company SentinelOne.