Key facts
- U.S. authorities seized platforms and domains used by Chinese state-sponsored hackers targeting critical infrastructure.
- The Justice Department and FBI conducted the operation, disrupting a campaign that targeted agencies including the Justice Department, NASA, the Federal Reserve, and the Senate.
- Malware platforms named QScan and QTRouter were seized.
- The hackers' victims included the U.S. Department of Energy, Department of Health and Human Services, National Institutes of Health, and four unnamed companies.
- The operation targeted networks since at least 2018, with some attempts unsuccessful.
U.S. authorities announced on Wednesday the disruption of a Chinese state-sponsored hacking operation that targeted critical infrastructure and sensitive government agencies. The Justice Department and FBI seized domains associated with two malware platforms, QScan and QTRouter, which were allegedly used in the campaign. The operation is reported to have compromised or attempted to compromise entities including the Justice Department, NASA, the Federal Reserve, and the U.S. Senate, with some attempts dating back to at least 2018.
According to a government affidavit, the hackers also targeted the U.S. Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and four unnamed companies in the U.S. and South Korea. The affidavit indicated that not all access attempts were successful, citing an unsuccessful attempt to breach NASA networks in August 2019 and unsuccessful attempts on the U.S. Senate and a hospital in March 2026. Successful data theft from defense contractors, financial institutions, and universities was reported in May 2024, and intrusions at Energy Department laboratories and an HHS agency occurred in September 2024.
The Justice Department stated that the platforms were operated by Nanjing Xinjiuwei Network Technology Company, a China-based firm with clients including China's Ministry of State Security and the People's Liberation Army. A spokesperson for the Chinese Embassy denied familiarity with the specifics but stated China opposes cyberattacks and accused the U.S. of using cybersecurity issues to discredit China. Experts note that private contractors often conduct such intrusions on behalf of Chinese government agencies.