The Campaign Targeted a Broad Range of Sensitive Networks in the United States and Other Countries in China

U.S. authorities attributed the campaign to a Chinese state-sponsored hacking group known as "QTFY, which allegedly operated through Nanjing Xinjiuwei Network Technology Company, a China-based cybersecurity firm established around 2018. According to the Justice Department, the company provided services to Chinese intelligence and military clients, including the Ministry of State Security and the People's Liberation Army." Investigators said the hackers developed and operated two complementary platforms, known as QScan and QTRouter, to conduct large-scale scans for vulnerable systems, exploit them, and maintain access while concealing the origin of their operations. The platforms also allegedly used networks of compromised internet-connected devices to route malicious traffic and make the intrusions appear to originate from elsewhere. The campaign targeted a broad range of sensitive networks in the United States and other countries.

In addition to NASA, the Federal Reserve and the Senate, identified U.S. targets included the departments of Justice, Energy, and Health and Human Services, as well as the National Institutes of Health. The hackers also targeted U.S. military networks, hospitals, energy and power companies, telecommunications providers, financial institutions and defense contractors. At least four companies in the United States and South Korea were also identified in court documents as targets.

As part of the operation, U.S. authorities obtained court orders to seize three internet domains associated with the Chinese company and its hacking infrastructure. Officials said the seizures were intended to disrupt the hackers' ability to operate, prevent further intrusions, and limit potential damage. Attorney General Todd Blanche and FBI Director Kash Patel described the operation as part of broader U.S. efforts to counter what Washington considers a persistent threat from Chinese state-sponsored cyber operations targeting American government networks and critical infrastructure. The Justice Department said federal agencies would also issue technical guidance detailing the hackers' methods and tools, allowing potential victims to identify and remove any remaining malicious access from their systems.