NASA Announces It's Looking for New Astronauts
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
A Delaware-based defense and aerospace company has settled a case with U.S. agencies over government allegations that the firm neglected its cybersecurity obligations in its contracts.
ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve the False Claims Act allegations involving its contracts with the Department of the Army, Missile Defense Agency and National Aeronautics and Space Administration.
ILC, according to the government, submitted false or fraudulent claims for payment on contracts with the agencies because it knew it hadn’t complied with the contracts’ cybersecurity requirements over a period between 2018 and 2024.
For instance, ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, and didn’t develop and update mandated security plans for each of its covered information systems.
“The best response to cyberattacks is to prevent them from happening in the first place,” Benjamin Wallace, U.S. Attorney for the District of Delaware, said in a news release Tuesday. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.”
American industrial manufacturing giant Ingersoll Rand, the parent company of ILC Dover, said it inherited the issue when it purchased the firm.
“We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” said Sara Hasell, a spokesperson for Ingersoll Rand. “We have agreed to resolve this matter with the U.S. Department of Justice without an admission of liability and remain committed to maintaining strong cybersecurity practices.”
The $13 million settlement is one of the bigger settlements since the Justice Department began using the False Claims Act in 2022 to penalize contractors over cybersecurity shortcomings. The False Claims Act is a Civil War-era law passed to deal with fraudulent contractors.
“To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division.
Under the law, a private citizen can raise allegations that the contractor defrauded the government and is entitled to receive a portion of any settlement. The whistleblower in the ILC case, Philip Root, the company’s former director of cybersecurity, will receive $2.35 million.
Government contract attorneys say that a forthcoming regulatory overhaul could expose more companies to False Claims Act punishments.
The post Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements appeared first on CyberScoop.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Federal authorities Wednesday revealed a multi-layered Chinese state-sponsored espionage operation that’s targeted and compromised U.S. critical infrastructure, including multiple federal agencies, since 2018.
Officials seized domains and unsealed an affidavit detailing how a Chinese government-funded front company assembled a botnet and complementary systems that allowed attackers to intrude highly sensitive networks.
The FBI and Justice Department said the state-sponsored group, known as “QTFY,” has targeted and intruded the networks of the Departments of Energy, Justice, Health and Human Services, the Federal Reserve, NASA, National Institutes of Health, and, unsuccessfully in March, the Senate.
Financial institutions, defense contractors, utility companies, telecom providers and hospitals have also been targeted by the threat group, which includes former members of China’s military, according to court records.
Officials said QTFY also attempted, but was unsuccessful, in gaining access to a U.S. election system in June.
The long-running operation, which officials obstructed by seizing malicious infrastructure, provided an expansive set of services. QTFY’s full hacking suite allowed attackers to scan and exploit vulnerabilities, infect IoT devices for a botnet, and conceal or reroute traffic.
QTFY’s operation was comprehensive with features that provided continuous reconnaissance capabilities and flexibilities designed for specific targets or objectives, said Ryan English, information security engineer at Lumen Technologies’ Black Lotus Labs, which aided the disruption efforts.
Officials said they seized three domains, which cut off access to QScan and QTRouter, the group’s primary platforms.
“Today’s announcement demonstrates the Justice Department’s steadfast commitment to going on the offensive against cyber threats to national security,” John A. Eisenberg, assistant attorney general for national security, said in a statement. “These court-authorized seizures deny People’s Republic of China-linked hackers access to tools they use to mount online attacks against our nation’s critical infrastructure.”
The FBI, National Security Agency and Cyber National Mission Force released a joint cybersecurity advisory with QTFY’s known indicators of compromise Wednesday. Officials also detailed the China-linked hacking group’s affiliations and collaborations with other state-sponsored groups.
QTFY targeted sensitive networks in the U.S. and globally by exploiting vulnerabilities in multiple vendors’ products, including Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.
QScan, the reconnaissance and vulnerability scanning tool, included more than 200 proof-of-concept exploits, according to court records.
“It was designed for large-scale deployment. On a single day in 2024 for example, QScan processed over two million scanning and exploit tasks,” a special agent for the FBI said in the affidavit.
The Chinese hacking collective exploited multiple Ivanti zero-day vulnerabilities in September 2024 to intrude the networks of three DOE national laboratories, NIH, an HHS agency and a U.S.-based security device manufacturer. Officials said the seized domains were all used in those attacks.
The FBI has been investigating QTFY, which operated out of a private China-based front company, Nanjing Xinjiuwei Network Technology Company, since at least 2019. The group has been consistently active for more than eight years.
“Discovery of these private companies building networks for China is becoming more frequent,” English said. “We’re starting to see that when they’re getting exposed, some of these have been in business a few years before they’re found.”
The takedown follows a series of technical operations aimed at dismantling China state-sponsored attackers’ infrastructure, including an operation in early 2025 that allowed officials to remove PlugX malware from thousands of U.S.-based computers.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Attorney General Todd Blanche said in a statement. “We are here to ensure security for the American people and will use every tool we have to keep that promise.”
The post Officials disrupt Chinese espionage operation that hit multiple federal agencies appeared first on CyberScoop.