{"id":444906,"date":"2026-08-27T07:54:19","date_gmt":"2026-08-27T07:54:19","guid":{"rendered":"https:\/\/www.newsbeep.com\/us-ca\/444906\/"},"modified":"2026-08-27T07:54:19","modified_gmt":"2026-08-27T07:54:19","slug":"fbi-san-diego-probe-leads-to-seizure-of-chinese-hacking-tools","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us-ca\/444906\/","title":{"rendered":"FBI San Diego probe leads to seizure of Chinese hacking tools"},"content":{"rendered":"

An investigation led by the FBI\u2019s San Diego field office has resulted in a takedown of online networks that were allegedly used by state-sponsored Chinese hackers to target federal agencies, large corporations and critical infrastructure across the United States and more than 130 other countries, the FBI and U.S. Department of Justice announced<\/a> Wednesday.<\/p>\n

Authorities said the U.S. targets of the hacking group known as QTFY included the military, NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services and the Senate. QTFY also allegedly targeted defense contractors, financial institutions, utility providers, public universities, hospital systems and additional government agencies at the local, state and federal levels.<\/p>\n

The FBI said it seized three domains linked to the group that were used to conceal the cyberattacks dating back to at least 2018. In conjunction with those seizures, the FBI and the National Security Agency released a 36-page cybersecurity alert<\/a> detailing some of QTFY\u2019s alleged activities<\/a>.<\/p>\n

\u201cThese tools were used by (People\u2019s Republic of China) cyber actors to hide the origin of their attacks,\u201d FBI Director Kash Patel said in a statement. \u201cThanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down.\u201d<\/p>\n

Officials from the FBI\u2019s San Diego field office told the Union-Tribune that the QTFY investigation was based here in part because the group \u201ctargeted and successfully exploited San Diego victims.\u201d The officials declined to identify what San Diego entities were hit by QTFY, but said there was another key reason why the investigation began here.<\/p>\n

\u201c(We had) a San Diego entity come forward, share a little tidbit of information, (and then) you get very talented people like the case agents who start pulling at that thread,\u201d FBI San Diego Supervisory Special Agent Brett Lally told the Union-Tribune. \u201cAnd then it blossoms into this great understanding of what\u2019s going on \u2014 very unique insight into what the adversary is doing. But again, it all hinged on someone coming forward and sharing a little bit of information with us.\u201d<\/p>\n

QTFY allegedly used two main networks to help hide its hacking activities and allegedly sold access to those networks to other hackers. One network was known as QScan and was used to scan and exploit vulnerable Internet of Things devices \u2014 essentially non-traditional devices that connect to the internet, such as smart thermostats and refrigerators.<\/p>\n

The other tool was called QTRouter and allegedly created a botnet, or a network of infected smart devices, that the hackers could use to route their traffic through in order to obfuscate their identities and locations.<\/p>\n

For example, if an IP address in China tried accessing a secure network of a U.S. government agency based in San Diego, that could set off alarm bells for the U.S. agency\u2019s cybersecurity experts or law enforcement. But if the same intrusion was routed through the IP address of a hacked smart device in San Diego, it might not raise the same red flags.<\/p>\n

\u201cThat\u2019s a strategic decision that (QTFY) \u2026 and others are taking to create and maintain access to infected devices in America, to use them against us, to use them in hacking attacks against the United States,\u201d Lally said.<\/p>\n

Once QTFY allegedly used its QScan and QTRouter tools to infect smart devices and create the botnet, it used more sophisticated hacking techniques to actually invade the networks of the government agencies and other entities it was targeting.<\/p>\n

\u201cThe advanced hacking they would do against the government agency would be a little different than they would do on somebody\u2019s (smart) device,\u201d an FBI San Diego case agent told the Union-Tribune. The FBI asked that the agent\u2019s identity be protected due to the sensitive nature of his work.<\/p>\n

The case agent said one particular intrusion in September 2024, also detailed in the FBI and NSA\u2019s joint cybersecurity advisory, made use of what\u2019s known as a zero-day attack.<\/p>\n

\u201cWhat a zero-day attack means is they\u2019ve found an exploit that nobody knows about, and that there\u2019s no way to stop it because nobody knows about it,\u201d the case agent said. \u201cThey successfully compromised \u2026 devices at three large Department of Energy laboratories, the National Institutes of Health and a large U.S. security device company.\u201d<\/p>\n

The case agent said the group also exploited artificial intelligence research and technology in its advanced hacking. \u201cThey\u2019re experts at finding vulnerabilities, including \u2026 zero-day exploits, and leveraging them against high-value targets,\u201d the case agent said.<\/p>\n

Federal authorities alleged that QTFY is part of a larger Chinese firm, the Nanjing Xinjiuwei Network Technology Company, that supports government-backed hacking units. Authorities alleged that some of the hackers employed by QTFY previously served in China\u2019s People\u2019s Liberation Army.<\/p>\n

Mark Remily, special agent in charge of the FBI\u2019s San Diego field office, told the Union-Tribune that QTFY sold network access and stolen data to customers that include China\u2019s Ministry of State Security and the People\u2019s Liberation Army.<\/p>\n

In an affidavit supporting the seizures<\/a> of the internet domains, an FBI agent wrote that payments from China\u2019s Ministry of State Security to Nanjing Xinjiuwei \u201cindicate that the company conducts malicious cyber activities on behalf of the PRC Government.\u201d<\/p>\n

Authorities said the three domains seized Wednesday were hard-coded into both the QScan and QTRouter malware, meaning the seizure would make those networks inoperable.<\/p>\n

Officials said the U.S. Attorney\u2019s Office in San Diego was also involved in the QTFY investigation, though it was unclear if the case would result in criminal charges against individuals allegedly associated with QTFY.<\/p>\n","protected":false},"excerpt":{"rendered":"An investigation led by the FBI\u2019s San Diego field office has resulted in a takedown of online networks…\n","protected":false},"author":2,"featured_media":444907,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28],"tags":[7,1312,138,181,23,100,74,84,76,75,1696],"class_list":["post-444906","post","type-post","status-publish","format-standard","has-post-thumbnail","category-san-diego","tag-california","tag-courts","tag-crime-and-public-safety","tag-latest-headlines","tag-local-news","tag-news","tag-san-diego","tag-san-diego-county","tag-san-diego-headlines","tag-san-diego-news","tag-top-stories-sdut"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/444906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/comments?post=444906"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/444906\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media\/444907"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media?parent=444906"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/categories?post=444906"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/tags?post=444906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}