The Justice Department and FBI dismantled a Chinese state-sponsored hacking operation, seizing the platforms behind breaches of NASA, the Federal Reserve, the DOJ, the U.S. Senate and other sensitive targets.
The Justice Department and FBI dismantled a Chinese state-sponsored hacking operation on Wednesday, seizing the internet domains behind two platforms used to breach NASA, the Federal Reserve, the Department of Justice, the U.S. Senate and other high-value targets. Court-authorized seizures shut the platforms down completely, cutting off a tool Beijing's spies and military relied on to hide their tracks.
The operation targeted two complementary hacking platforms known as QScan and QTRouter, which the DOJ said were used to attack U.S. critical infrastructure and other sensitive networks. Court documents unsealed in the U.S. District Court for the Southern District of California identified the group behind them as QTFY, a Chinese state-sponsored outfit employed by Nanjing Xinjiuwei Network Technology Co.
QTFY offered its hacking services to paying customers, including the People's Republic of China's Ministry of State Security and the People's Liberation Army, according to court documents. The two platforms worked in tandem to give Beijing a powerful, hard-to-trace attack capability.
QScan automatically scanned and infected thousands of internet-of-things devices around the world, pulling them into the QTRouter network. QTRouter then served as an obfuscation network made up of compromised IoT devices, commercial proxy service devices and leased virtual private servers, allowing QTFY and its clients to conceal the Chinese origin of their intrusions. Malicious traffic appeared to originate from computers outside China, sometimes from machines local to the targeted networks themselves.
Because the seized domains were hard-coded into both platforms and used for essential tasks like communication and authentication, the seizures rendered QScan and QTRouter inoperable.
The DOJ identified NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate as victims of QTFY's computer intrusion activity. Court filings also listed hospitals, telecommunications providers, power companies, financial institutions and defense contractors among the targeted networks.
Federal officials did not detail the extent of the damage inside the breached agencies. The disclosure lands at a sensitive moment for the central bank: a former senior adviser to the Federal Reserve Board of Governors, John Harold Rogers, was sentenced in July to 38 months in prison for lying to investigators about sharing restricted monetary policy information with Chinese intelligence operatives.
Attorney General Todd Blanche said the takedown reflects a simple promise to the American people. "State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted," Blanche said. "We are here to ensure security for the American people and will use every tool we have to keep that promise."
FBI Director Kash Patel framed the seizure as a direct win for President Trump's Cyber Strategy for America. "Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure," Patel said. "These tools were used by PRC cyber actors to hide the origin of their attacks." Patel added that the FBI is surging efforts to shape adversary behavior and defend the homeland in cyberspace.
The FBI's San Diego Field Office, its Cyber Division, the U.S. Attorney's Office for the Southern District of California and the Justice Department's National Security Division led the investigation.
Wednesday's action is the latest in a series of U.S. technical operations against Chinese hacking infrastructure. In 2025, the FBI removed PlugX surveillance malware from more than 4,000 U.S. computers infected by the PRC-sponsored group Mustang Panda. In 2024 it disabled a botnet of hundreds of thousands of infected IoT devices that the group Flax Typhoon provided to Chinese government customers, and in 2023 it disrupted a botnet used by Volt Typhoon to hide its exploitation of U.S. and foreign critical infrastructure.
The FBI and National Security Agency also published a joint cybersecurity advisory Wednesday providing indicators of compromise tied to QTFY activity dating back to at least 2018, and Lumen Technologies' threat intelligence group published its own technical breakdown of the group's methods.
The takedown deprives Beijing of a proven intrusion tool, but China's cyber ecosystem is deep, and the administration is signaling this is only the beginning. Expect more domain seizures, more unsealed indictments and more pressure on the commercial front companies that staff these operations. The message from Washington is unambiguous: attacking American infrastructure carries a price, and the bill keeps getting collected.
The Justice Department and FBI dismantled a Chinese state-sponsored hacking operation, seizing the platforms behind breaches of NASA, the Federal Reserve, the DOJ, the U.S. Senate and other sensitive targets.
freedomlinedispatch.com
