US Disrupted Chinese Hacking Campaign Targeting DOJ, NASA and Federal Reserve

Dismantling the QScan and QTRouter Botnet Infrastructure

According to unsealed court documents filed in the Southern District of California, the cyber-intrusions were orchestrated by a Beijing-backed group known as “QTFY.” This threat actor group is operated through the Nanjing Xinjiuwei Network Technology Company. Federal officials state that the network functioned by deploying QScan to automatically infect thousands of internet-of-things devices across the globe. These compromised devices were subsequently incorporated into the QTRouter network, which served as an obfuscation layer designed to conceal the geographic origins of the attacks.

Attorney General Todd Blanche emphasized the gravity of the operation in an official statement. State-sponsored malicious hackers targeting American critical infrastructure will face aggressive federal prosecution, according to Blanche, who noted that law enforcement agencies worked collaboratively to neutralize the malicious software. FBI Director Kash Patel added that the bureau’s actions directly support the administration’s broader cyber strategy aimed at shaping adversary behavior in digital spaces.

The federal affidavit reveals that the threat group maintained access to targets globally since at least 2018. The campaign’s scope extended far beyond initial civilian agency breaches, touching the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. Additional foreign and domestic targets included four unnamed corporate entities located in the United States and South Korea.

Historical Precedents and the Threat Landscape

This coordinated disruption mirrors previous federal efforts to combat foreign state-sponsored cyber operations through public indictments and domain seizures. Michael Lebowitz, a former senior attorney in the DOJ’s National Security Division, characterized the announcement to USA TODAY as a strategic name-and-shame campaign. Publicly exposing these networks signals to foreign adversaries that federal monitors actively track their movements, even when direct extradition remains unlikely.

Private cybersecurity analysts note that the proliferation of specialized corporate contractors operating on behalf of state intelligence agencies has complicated defensive postures. Dakota Cary, a China analyst with SentinelOne, observed to Reuters that the commercial market for niche offensive cyber services has expanded significantly over the past decade. These private entities frequently execute high-profile intrusions for organizations such as China’s Ministry of State Security and the People’s Liberation Army.

Federal agencies have faced continuous pressure from foreign actors. Earlier in the year, the FBI informed Congress that hackers had compromised networks tied to individuals under active bureau investigation. Additional compromises in recent years have impacted U.S. House of Representatives committee networks and major domestic telecommunications providers.

Mitigating Enterprise Risk and Securing Critical Infrastructure

Federal investigators have not publicly detailed the specific volume of data extracted during the multi-year intrusion campaign, citing ongoing security classifications. As the investigation continues, the Department of Justice maintains that domain seizures and software neutralization remain primary mechanisms for disrupting foreign espionage operations before they achieve wider systemic impact.