US court filings cite Chinese state-linked hacking targeting major US institutions

Experts see evidence of growing Chinese hacking threat in newly released court documents.

The US government said it seized digital infrastructure behind a Chinese hacking operation that targeted NASA, the Federal Reserve, and the Senate beginning in 2018, evidence, experts say, that illustrates the growing scale and persistence of Beijing’s cyber operations.

The court documents show China is “doubling down” on a long-suspected cyber strategy, said Lauryn Williams, former director for strategy in the White House Office of the National Cyber Director under President Joe Biden. “It both emphasizes that [China] is going to continue to find creative ways to target specific infrastructure and also, on the flip side, for the United States, that our infrastructure continues to be vulnerable,” she said.

The Justice Department said this week that it seized three domains used by hackers it believes are linked to a Chinese state-sponsored group known as QTFY.

According to court documents, QTFY operated two complementary hacking platforms which the Justice Department said were used against the Justice Department, NASA, the Federal Reserve, the Senate, the Department of Health and Human Services, the National Institutes of Health, the Department of Energy.

The length of the campaign and evidence of data theft suggest “classic espionage,” said Nikita Shah, a senior fellow in the Intelligence, National Security, and Technology Program at the Center for Strategic and International Studies, adding that the activity also raises concerns about the theft of US intellectual property, particularly given the national laboratories and defense contractors allegedly targeted. “It’s operations like this that enable China to get intellectual property theft that then converts into economic gain,” Shah said.