[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyYPMWSVDcv2fdgcY5N8akWa8EVUhVyS25wAWseIa73E":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8a641fde-4faf-4de3-9df6-f6565df16ba8","Officials disrupt Chinese espionage operation that hit multiple federal agencies","officials-disrupt-chinese-espionage-operation-that-hit-multiple-federal-agencies-d1bb8a","The full hacking suite, seized by authorities, allowed Chinese government funded attackers to intrude highly sensitive networks undetected for more than eight years. The post Officials disrupt Chinese espionage operation that hit multiple federal agencies appeared first on CyberScoop.","Federal authorities have disrupted a sophisticated, state-sponsored espionage operation linked to China, which had been targeting U.S. critical infrastructure and federal agencies since 2018. The operation, conducted by a group known as QTFY, utilized a comprehensive hacking suite including botnets and vulnerability exploitation tools. Officials seized malicious domains and infrastructure, effectively hindering the group's ability to conduct reconnaissance and exploit vulnerabilities in various vendor products.","US officials disrupt Chinese state-sponsored espionage operation targeting federal agencies.","https:\u002F\u002Fcyberscoop.com\u002Fqtfy-china-espionage-group-infrastructure-seized\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F04\u002FGettyImages-1332529886.jpg","2026-08-26T19:35:05+00:00","2026-08-26T20:00:10.547821+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"QTFY","threat_actor",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Fortinet",{"name":26,"type":22},"Citrix",{"name":28,"type":22},"F5",{"name":30,"type":22},"Ivanti","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":57,"vendors":143},[58,87,115],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,107],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":101,"vendor_name":30,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":53,"name":116,"problem":117,"products":118},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[144,149,153,157,159],{"slug":145,"name":26,"logo_path":146,"roles":147},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[148],"affected",{"slug":150,"name":28,"logo_path":151,"roles":152},"f5","\u002Fvendor-logos\u002Ff5.png",[148],{"slug":154,"name":24,"logo_path":155,"roles":156},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[148],{"slug":101,"name":30,"logo_path":102,"roles":158},[148],{"slug":160,"name":21,"logo_path":161,"roles":162},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":180},"chinese-state-sponsored-group-qtfy-targets-federal-agencies-via-botnets-and-vulnerability-exploitati","Chinese State-Sponsored Group QTFY Targets Federal Agencies via Botnets and Vulnerability Exploitation","The QTFY espionage operation demonstrates how persistent, state-sponsored threat actors can maintain long-term access to critical infrastructure by systematically exploiting unpatched vulnerabilities in vendor products over many years. Operating since 2018, the group leveraged botnets and reconnaissance tools to quietly map and penetrate federal agency networks, highlighting dangerous gaps in vulnerability management and network visibility. The extended dwell time — potentially years — underscores the critical importance of continuous monitoring and rapid detection of anomalous activity. When adversaries can conduct reconnaissance undetected for extended periods, the damage to national security and data integrity can be severe and far-reaching.",[168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST Cybersecurity Framework DE.CM-1 – Network Monitoring","NIST Cybersecurity Framework ID.RA-1 – Asset Vulnerabilities Identified","CISA Binding Operational Directive 22-01 – Known Exploited Vulnerabilities Catalog","FISMA – Federal Information Security Modernization Act","Executive Order 14028 – Improving the Nation's Cybersecurity",{}]