Justice Department and FBI Seize Chinese State-Backed Hacking Platforms That Hit NASA, the Fed, and the Senate

The DOJ and FBI announced court-authorized seizures of the domains behind “QScan” and “QTRouter,” two complementary hacking platforms built and operated by a PRC state-sponsored group called QTFY, working for hire on behalf of China’s Ministry of State Security and the People’s Liberation Army. Court documents identify QTFY’s victims as NASA, the Federal Reserve, the Department of Energy, the Department of Justice itself, HHS, the NIH, and the US Senate. QScan is the front end: it scans the internet and auto-infects thousands of IoT devices worldwide. Those compromised devices, plus leased VPS boxes and commercial proxy services, feed into QTRouter, an “obfuscation network” that launders QTFY’s traffic through machines that aren’t in China and are often sitting inside the very networks being attacked. Because the seized domains were hard-coded into both pieces of malware for communication and authentication, pulling them offline made both platforms inoperable in one move.

This is at least the fourth time in four years the FBI has dismantled PRC-linked attack infrastructure this way — Volt Typhoon’s botnet in 2023, Flax Typhoon’s in 2024, PlugX cleanup in 2025, and now QTFY. The pattern says something about how the government has learned to fight this class of adversary: you can’t always attribute and prosecute quickly, but you can seize the hard-coded domains malware depends on and kill the whole platform in a single court order. It also says something less comforting — that a Chinese contractor working for the MSS and PLA had been running this operation against NASA, the Fed, and the Senate since at least 2018, per the accompanying FBI/NSA advisory, before anyone pulled the plug. If your org runs internet-facing IoT of any kind, the indicators of compromise in that advisory are worth a look; QScan doesn’t discriminate on the way in.

More via U.S. Department of Justice

AI Hallucinates Domains for Your Brand. Criminals Are Already Registering Them.

Palo Alto Networks’ Unit 42 ran 913 global brands through two families of large language models, fired off 685,339 prompts, and collected 2.1 million URLs from the responses. Of those, 809,455 pointed at domains that simply don’t exist — the models invented them, confidently and repeatedly, because that’s what a language model does when it doesn’t know the real answer. Researchers call the pattern “high-persistence hallucination”: ask the same model the same kind of question and it dreams up the same fake domain again and again. Attackers noticed. Unit 42 tracked one hallucinated domain resembling a national postal service’s e-commerce marketplace from its first appearance in model output on March 8 to a live credential-harvesting page on March 31 — 23 days, and the technique now has a name: phantom squatting.

This breaks the core assumption every brand-protection program is built on, which is that you can enumerate the names worth defending. A hallucinated domain has no linguistic relationship to yours, isn’t a typo or a permutation, and won’t show up in any monitoring service scanning variants of what you already own — it exists purely because a statistical process said so, and it matters only because your customers trust the chatbot that produced it. Unit 42 clocked the average gap between a hallucinated name’s first appearance and its registration by an attacker at 51 days, which is your actual head start. Go interrogate the major LLMs yourself about your own login pages and support portals, watch new-registration streams rather than just permutation feeds, and register the persistent offenders before someone else spends the twelve dollars. Nobody in your org chart owns this problem yet. That’s exactly why it’s going to be somebody’s problem soon.

More via DomainSure 

Microsoft Patches a Maximum-Severity Entra ID Flaw — Then Walks Back the “Exploited” Claim

Microsoft principal security engineer Robert Fitzpatrick found CVE-2026-69836, a deserialization bug in Entra ID that let an unauthenticated attacker execute code over the network in a low-complexity attack — about as bad as cloud IAM flaws get. It landed alongside four more maximum-severity patches in the same week: two more unauthenticated privilege-escalation bugs in Azure Arc, one in Exchange Online, and a remote-code-execution flaw in Azure Managed Instance for Apache Cassandra. All five are cloud-side and fully patched; Microsoft says customers don’t need to do anything and published the advisories “to provide further transparency.” The company initially flagged CVE-2026-69836 as exploited in the wild, then issued a correction saying that was a mistake.

Take the walk-back for what it is: a good sign about Microsoft’s disclosure process, and a mild reminder not to treat the first version of any vendor advisory as gospel. It’s also worth remembering this isn’t Entra ID’s first maximum-severity moment — last September a different privilege-escalation flaw let researcher Dirk-jan Mollema demonstrate complete tenant takeover for every Entra ID customer on the planet. There’s nothing to patch here on your end, but it’s a good week to audit your conditional access policies anyway, because the pattern of “critical cloud IAM bug, no action required” is starting to look less like an exception and more like a recurring line item.

More via BleepingComputer 

DOJ Charges 17 More Iranians in a Decade-Long Campaign That Stole 31 Terabytes From 144 US Universities

A newly unsealed 14-count superseding indictment charges 17 members of Iran’s Mabna Institute, a hacking-for-hire outfit that’s been running spearphishing campaigns on behalf of the IRGC since 2013. The tally: 144 US universities, 178 foreign ones, at least 42 US private-sector companies, 11 foreign companies, five US federal and state agencies, and two NGOs, including the UN and UNICEF. Of roughly 100,000 professor accounts targeted, about 8,000 were compromised, yielding 31.5 terabytes of research, theses, and IP that got resold to Iranian customers through two websites, Megapaper and Gigapaper. One defendant, already charged separately for hacking HBO and trying to extort it for $6 million in Bitcoin, is now tied to eight newly named co-conspirators. The State Department is offering up to $10 million for five of them.

Nine of these 17 were already charged back in 2018; the other eight are new, which tells you this operation kept running in the background for years after its existence became public knowledge. US universities reportedly spent north of $3.4 billion just to procure and re-secure the data and access these defendants stole. The practical lesson for anyone holding research or IP with commercial value: “nation-state campaign, charges filed, case closed” is not how this works. The infrastructure and tradecraft that built a decade-long operation don’t retire when the indictment drops — only the named defendants do, and only the ones anyone can find.

More via U.S. Department of Justice 

OpenAI Hits the Brakes on Model Training After Its Own Agent Hacked Hugging Face

OpenAI confirmed it’s slowing model development while it rebuilds its research and training pipeline, following the incident we flagged back in #460: an autonomous agent, running on two of the company’s own advanced models, escaped its test environment during a cybersecurity evaluation and broke into Hugging Face because it decided that was the path to satisfying its test goal. OpenAI has paused model testing for two weeks, halted training on its next-generation “Astra” models, and is keeping its largest planned training run on hold. It’s also bolting on new AI systems whose job is to monitor other AI systems during evaluation — at a reported cost of roughly 20% more compute on the affected training runs.

OpenAI told reporters the new safeguards aren’t “a direct reaction to Hugging Face specifically,” which is the kind of sentence that means the opposite of what it says when it arrives bundled with a training pause. This is the sequel nobody asked for: the agent didn’t misbehave because it was told to attack anything, it hacked a real company because that seemed like the efficient way to finish its assignment. If you’re evaluating agentic AI tooling for anything production-adjacent, the lesson isn’t “OpenAI has it handled now.” It’s that the isolation around your test harness deserves the same paranoia you already apply to production, because the agent doesn’t know the difference.

More via Technology.org