DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

The investigation first separated the August 2026 correction from the broader QTFY disruption and from the historical Pulse Connect Secure vulnerability. The corrected Justice Department release confirms that named agencies were targets, while Black Lotus Labs independently supports the wider reconnaissance and obfuscation campaign. NVD, CISA and original vulnerability research confirm CVE-2019-11510's technical scope, prior exploitation and public exploit availability, but they do not demonstrate a new 2026 exploitation wave.

1. What claim was corrected, and which historical vulnerability was associated with the story?
   Read the supplied report and followed its cited primary and independent references.
   thehackernews.com ↗

   The report says the Justice Department changed named agencies from victims to targets and alleges that QTFY attempted to access NASA through CVE-2019-11510 in 2019.

   why This framed the event as a correction to compromise claims, not a newly disclosed CVE campaign.

2. What does the corrected government record actually allege?
   Read the updated Justice Department announcement and its revision note.
   justice.gov ↗

   The release identifies the agencies as QTFY targets, attributes QScan and QTRouter to QTFY, says seized hard-coded domains made the tools inoperable and records an update on 28 August 2026.

   why This is the strongest evidence for both the corrected wording and the scope of the disruption.

3. Is there independent technical corroboration of the QTFY campaign and its target scope?
   Reviewed Black Lotus Labs' research into the quartermaster infrastructure.
   lumen.com ↗

   Researchers observed distributed reconnaissance, commercial-proxy and relay infrastructure, probable exploitation sessions and targeting of government, defence, research, healthcare, energy and financial networks.

   why This independently corroborates the infrastructure and sector targeting while distinguishing reconnaissance from confirmed compromise.

4. What products and versions are affected by CVE-2019-11510?
   Read the National Vulnerability Database record.

   Pulse Connect Secure 8.2 before 8.2R12.1, 8.3 before 8.3R7.1 and 9.0 before 9.0R3.4 allow unauthenticated arbitrary file reading through a specially crafted URI.

   why This established the defensible technical scope and minimum historical fixed versions without inferring a broader exploit chain.

5. Has CVE-2019-11510 been exploited in the wild independently of the QTFY allegation?
   Filtered and reviewed the CISA Known Exploited Vulnerabilities catalogue entry.

   CISA lists the vulnerability as known exploited, records known ransomware use and directs organisations to apply vendor updates.

   why This confirms historical exploitation risk but does not establish current QTFY use or exploitation against every named target.

6. Is technical disclosure or public exploit material available?
   Reviewed the original DEVCORE vulnerability research.
   devco.re ↗

   DEVCORE documents the vulnerability, reports patches released on 24 April 2019 and states that third parties subsequently published exploit implementations.

   why This confirmed that exploitation knowledge has been public for years and that proof-of-concept availability is not evidence of a new campaign.

7. Does a cited public exploit repository still exist?
   Opened the CVE-2019-11510 repository linked by the original researchers.
   github.com ↗

   The public repository remains available and identifies itself as an arbitrary file-read exploit for Pulse Secure SSL VPN.

   why This directly verifies public exploit-code availability without relying on a search-result description.

8. Does the supplied community record add evidence of current actor activity?
   Read the referenced community-maintained CVE index.
   raw.githubusercontent.com ↗

   The record lists CVE-2019-11510 and points to the same public repository but contains no time-bounded QTFY discussion or evidence of current exploitation.

   why It corroborates public code availability only and should not be treated as proof of active campaign activity.

9. What additional campaign context was reported around the original disruption announcement?
   Reviewed the earlier detailed report on the FBI disruption.
   thehackernews.com ↗

   The report describes QTFY's alleged customers, QScan and QTRouter infrastructure, broad vulnerability-led targeting and persistence activity, while preserving the distinction between scanning, exploitation and compromise.

   why This supplied context for the broader campaign but remained secondary to the corrected Justice Department record and independent Lumen research.