Washington said Wednesday it had knocked out a Chinese hacking operation that broke into, or tried to break into, some of the most sensitive networks in the United States. The Justice Department and FBI announced court-authorized seizures of domains used by two platforms, QScan and QTRouter, run by a state-sponsored group the department calls QTFY. Among the victims named in unsealed court papers: NASA, the Federal Reserve, the Energy Department, the Justice Department itself, Health and Human Services, the National Institutes of Health, and the U.S. Senate. Reuters, citing the affidavit, also listed four unnamed companies in the United States and South Korea.
The tools belonged to Nanjing Xinjiuwei Network Technology Company, a China-based firm whose clients, the department said, included the Ministry of State Security and the People’s Liberation Army. QScan scans and infects internet-of-things devices worldwide. Those machines, plus commercial proxies and leased servers, feed QTRouter, an “obfuscation network” that makes Chinese-origin traffic look as if it is coming from somewhere else — sometimes even from inside the target country. Because the seized domains were hard-coded into both platforms for communication and authentication, the seizures made them inoperable. FBI Assistant Director Brett Leatherman said QTFY exploited devices in more than 130 countries and that Nanjing Xinjiuwei “sells stolen data and hacking services to Chinese military and intelligence agencies.”
The affidavit traces the infrastructure to at least 2018. Hackers unsuccessfully tried to get into NASA in August 2019 through a Pulse Secure VPN hole. In September 2024, the filing said, they got into three unnamed Energy Department laboratories, the NIH, an unnamed HHS agency, and a U.S. security-device maker. Investigators kept going through an attack on the Senate this year; the affidavit does not say which senators or committees. Attorney General Todd Blanche said “state-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted.” FBI Director Kash Patel called it “just the latest technical operation against PRC-sponsored hacking.”
The Chinese embassy in Washington did not immediately comment. Beijing routinely denies hacking. Reuters could not immediately reach Nanjing Xinjiuwei. Dakota Cary, a China analyst at SentinelOne, told Reuters that over the last decade “the number of companies offering niche offensive services has exploded.” The FBI and NSA published a cybersecurity advisory on QTFY the same day. This is the department going after the plumbing, not a courtroom conviction. The claim is that the plumbing ran through NASA, the Fed, and the Senate.
Sources: U.S. Department of Justice; Reuters; The Record (Recorded Future News).