US seizes domains of botnet authorities link to China
The FBI seized a number of domains that a large botnet used to coordinate and carry out cyberattacks against US targets. According to the US Department of Justice, the seizure deprived the operators of access to domains necessary for the network's operation.
As TechCrunch reports, US prosecutors said that the Chinese state-linked group QTFY operated under the direction of the Chinese company Nanjing Xinjiuwei Network Tech. According to the US Department of Justice, the company created and operated a botnet consisting of thousands of compromised internet-connected devices.
A network for disguising traffic
US authorities claim that the botnet served as a network for disguising hackers' malicious traffic, making it more difficult to detect their activity. According to prosecutors, QTFY offered computer-system hacking services to clients, including hackers working for China's Ministry of State Security, and provided them with access to the botnet.
More current news is available on the UA.News Telegram channel Telegram.
According to the US Department of Justice, the breaches began in 2018 and affected the systems of hospitals, defense contractors, and several federal agencies. The affected institutions included NASA, the Federal Reserve System, and the US Departments of Energy, Justice, and Health and Human Services.
Botnet declared inoperable
The US Department of Justice said that after the domains were seized, the botnet and its command-and-control servers became inoperable. The domains were embedded in the network's code and were critical to the botnet's communications and core operations.
An affidavit filed to obtain court authorization for the seizure of the domains states that the US Senate was compromised in 2026. Lumen said that over the past year it had observed hackers studying and targeting government agencies, the defense sector, and the aerospace sector, and subsequently provided threat data to the FBI.
