U.S. Disrupts Chinese State-Sponsored Hacking Network Targeting Government Agencies

The United States Department of Justice and the FBI announced on Wednesday the disruption of a Chinese state-sponsored hacking operation that targeted critical U.S. infrastructure and sensitive government networks. Federal authorities seized internet domains used by two hacking platforms known as QScan and QTRouter. These tools were allegedly operated by a China-based firm called Nanjing Xinjiuwei Network Technology Company, which the U.S. government identifies as a contractor for the Ministry of State Security and the People's Liberation Army. The hacking group, identified as QTFY, has been active since at least 2018.

Victims of the campaign include NASA, the Federal Reserve, the U.S. Senate, the Department of Justice, the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health. The operation also targeted hospitals, telecommunications providers, power companies, financial institutions, and defense contractors. Some reports specify that the group successfully stole data from defense contractors and financial institutions in May 2024, while other attempts, such as a 2019 effort to breach NASA, were unsuccessful.

Technical details provided by the FBI and Lumen Technology indicate that the group used botnets of hacked internet-of-things devices and co-opted commercial proxy services to hide their activity. More recently, the group allegedly hijacked virtual private network services used by Chinese citizens to blend malicious traffic with benign user data. Attorney General Todd Blanche described the seizure as part of a series of operations to dismantle indiscriminate hacking sponsored by the People's Republic of China.

The Chinese embassy in Washington denied the allegations, stating that the Chinese government opposes all forms of cyberattacks. A spokesperson urged the U.S. to stop using cybersecurity issues to smear China and accused the U.S. of overstretching the concept of national security to restrict Chinese companies. The announcement comes approximately one month before a planned meeting between President Donald Trump and President Xi Jinping at the White House.