How a China-Linked Hacking Operation Targeted U.S. Networks
Some cyberattacks start with a suspicious email, but others exploit vulnerabilities you might never expect. An old router or forgotten security camera connected to the internet can be a weak link. Hackers compromise these devices to conceal their attack’s origin. This tactic was part of a China-linked hacking operation targeting sensitive U.S. networks.
Extent of the Breach
On August 26, U.S. authorities confirmed that since 2018, attempts to intrude on networks, including NASA, the Federal Reserve, and the U.S. Senate, were made. Other targets included the Department of Energy and the Department of Health and Human Services. Four companies in the U.S. and South Korea were also targeted.
‘These tools were used by PRC cyber actors to hide the origin of their attacks.’
The Hacking Operation
U.S. authorities linked the operation to a Chinese state-sponsored group called QTFY. The group reportedly used the platforms QScan and QTRouter, working for the Nanjing Xinjiuwei Network Technology Company. U.S. officials allege the company offered hacking services to China’s Ministry of State Security and the People’s Liberation Army.
How QScan and QTRouter Worked
QScan identified vulnerable systems and infected thousands of IoT devices globally. These devices became part of QTRouter, an obfuscation network that masked the true origins of attacks, making them appear to come from elsewhere.
Response from Authorities
The Justice Department seized domains essential for the operation of QScan and QTRouter, rendering them inoperative. This tactic effectively dismantled the obfuscation network.
Protecting Your Devices
While you can’t stop nation-state hackers, you can secure your devices:
- Update router firmware regularly.
- Replace routers that no longer receive updates.
- Change default passwords on routers and connected devices.
- Use a strong Wi-Fi password and WPA3 encryption.
- Disable unused features like remote administration and UPnP.
- Put smart devices on a separate network.
- Keep all devices updated and secure.
Conclusion
The attack highlights the importance of securing connected devices. Vulnerable equipment can become part of a hacker’s network, even if you aren’t the target. Regularly check and update your connected devices to protect your network.