US Disrupts Chinese Hacking Operation Targeting NASA, Federal Reserve and DOJ
The U.S. Justice Department announced on August 26, 2026, that it disrupted a Chinese state-sponsored cyber operation responsible for unauthorized intrusions into sensitive federal networks, including the Department of Justice, NASA, the Federal Reserve, and the U.S. Senate, utilizing seized internet domains to dismantle the malicious infrastructure.
Dismantling the QScan and QTRouter Botnets
Federal law enforcement executed technical operations to disable malicious software and seize internet domains tied to two distinct hacking platforms named “QScan” and “QTRouter.” According to court documents unsealed in the Southern District of California, these platforms were engineered and operated by the China-based Nanjing Xinjiuwei Network Technology Company. The campaign was attributed to a Beijing-backed state-sponsored hacking group designated as “QTFY.”
Attorney General Todd Blanche stated that federal law enforcement investigated and disabled the software as part of an ongoing effort to combat foreign intrusions into critical infrastructure. “State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Blanche said in a public statement. FBI Director Kash Patel added that the bureau played a central role in targeting the global botnet, emphasizing that the federal government is surging resources to defend domestic networks in cyberspace.
Targeted Federal Agencies and Long-Term Compromise
Court records detail a list of government entities compromised or targeted by the QTFY infrastructure since at least 2018. Alongside the Department of Justice, NASA, the Federal Reserve, and the Senate, the intrusions extended to the Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four unnamed corporate entities located in the United States and South Korea.
Investigative filings reveal varying degrees of access over the years. In August 2019, hackers attempted to breach NASA networks by exploiting a virtual private network vulnerability. By September 2024, the group carried out intrusions targeting three distinct Energy Department laboratories, the NIH, an HHS agency, and a domestic security device manufacturer. U.S. officials did not release a comprehensive damage assessment, citing the classified nature of such reviews.
Michael Lebowitz, a former senior attorney in the Justice Department’s National Security Division, noted that publicizing the indictments functions as a strategic deterrent. “The U.S. often takes similar tactics when indicting foreign hackers” because formal trials are unlikely to occur, Lebowitz explained regarding the public call-out strategy.
Operational Tactics of the QTFY Network
The infrastructure operated through an interconnected mechanism where QScan automatically scanned and infected thousands of Internet-of-Things (IoT) devices across the globe. These compromised endpoints were subsequently folded into the QTRouter network, which acted as an obfuscation layer to mask the true origin of the Chinese state-linked cyber activities.
According to cybersecurity analysis from SentinelOne’s China analyst Dakota Cary, the reliance on private commercial contractors for high-profile espionage has expanded significantly over the past decade. Court filings indicate that Nanjing Xinjiuwei provided these offensive cyber services directly to paying customers that included China’s Ministry of State Security and the People’s Liberation Army.
In response to the federal announcements, the Chinese Embassy in Washington issued a statement rejecting the allegations. The embassy maintained that Beijing “firmly opposes and combats all forms of cyberattacks in accordance with the law” and urged Washington to cease using cybersecurity matters to discredit Chinese commercial entities.