US authorities said they had disrupted a Chinese state-linked hacking operation that infiltrated the networks of the Justice Department, NASA, the Federal Reserve, the Senate and other sensitive US institutions, reports "Reuters".
The Justice Department and the FBI have seized domains used by two hacking platforms known as QScan and QTRouter. According to court documents, they were created and operated by a group calling itself QTFY and working for the China-based company Nanjing Xinjiuwei Network Technology.
The Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and four unnamed companies in the United States and South Korea were also identified as victims of the attack. U.S. authorities say the group’s infrastructure has been used to compromise critical infrastructure and other sensitive networks in the United States and around the world since at least 2018.
According to the Department of Justice, Nanjing Xinjiuwei’s clients include China’s Ministry of State Security, which performs civilian intelligence functions, and the People’s Liberation Army of China. Some of the QTFY members are former members of the Chinese military and used their contacts there to obtain contracts for offensive cyber operations, the court documents state.
The two platforms performed different but complementary functions. QScan scanned the Internet for vulnerable devices and automatically infected thousands of devices from the so-called Internet of Things - routers, cameras and other connected equipment.
The compromised devices were then included in QTRouter - a network that allowed hackers to disguise the true origin of their attacks. Thus, malicious traffic could appear to come from computers outside China or even from devices located near the attacked organization.
The domains seized by US authorities were built directly into the QScan and QTRouter software and were necessary for the platforms to communicate and authenticate. That's why the FBI and Justice Department operation rendered them unusable, authorities say.
US Attorney General Todd Blanch said Washington would use all available tools against foreign-sponsored hackers who attack critical US infrastructure.
FBI Director Kash Patel described the operation as disrupting a "global botnet and hacking platform" used by Chinese-backed cyber operators to attack US sites.
The Chinese Embassy in Washington did not immediately respond to a request for comment. Beijing has consistently denied accusations by the United States and other Western countries that it organizes or supports hacking operations.
Experts on Chinese cyber operations have noted that in recent years Beijing has increasingly used private companies as contractors for intelligence and offensive operations.
"Over the past decade, the number of companies offering specialized offensive services has exploded," said SentinelOne analyst Dakota Carey.
The current operation is the latest US action against China-linked cyber networks. In 2025, the FBI removed the PlugX spyware from more than 4,000 infected American computers, and in 2024 and 2023, it disrupted botnets used by the Chinese groups Flax Typhoon and Volt Typhoon to cover up attacks on critical infrastructure.