Officials disrupt Chinese espionage operation that hit multiple federal agencies
US officials disrupt Chinese state-sponsored espionage operation targeting federal agencies.
Federal authorities have disrupted a sophisticated, state-sponsored espionage operation linked to China, which had been targeting U.S. critical infrastructure and federal agencies since 2018. The operation, conducted by a group known as QTFY, utilized a comprehensive hacking suite including botnets and vulnerability exploitation tools. Officials seized malicious domains and infrastructure, effectively hindering the group's ability to conduct reconnaissance and exploit vulnerabilities in various vendor products.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe QTFY espionage operation demonstrates how persistent, state-sponsored threat actors can maintain long-term access to critical infrastructure by systematically exploiting unpatched vulnerabilities in vendor products over many years. Operating since 2018, the group leveraged botnets and reconnaissance tools to quietly map and penetrate federal agency networks, highlighting dangerous gaps in vulnerability management and network visibility. The extended dwell time — potentially years — underscores the critical importance of continuous monitoring and rapid detection of anomalous activity. When adversaries can conduct reconnaissance undetected for extended periods, the damage to national security and data integrity can be severe and far-reaching.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.