started · updated
U.S. authorities disrupt Chinese cyber-espionage targeting NASA and federal agencies
U.S. federal authorities, including the Department of Justice and the FBI, have disrupted a long-running Chinese state-sponsored cyber-espionage operation. The operation, linked to a group known as QTFY and the China-based Nanjing Xinjiuwei Network Technology Company, has been active since at least 2018.
Authorities seized three internet domains to disable two primary hacking platforms: QScan and QTRouter. QScan was used to automatically scan and infect thousands of Internet-of-Things (IoT) devices globally, while QTRouter functioned as an obfuscation network to hide the origin of attacks by routing traffic through compromised devices.
Targets included highly sensitive institutions such as NASA, the Federal Reserve, the U.S. Senate, the Department of Energy, the Department of Justice, and the National Institutes of Health. The campaign also impacted hospitals, telecommunications providers, defense contractors, and financial institutions. Some victims included companies in the United States and South Korea. While some intrusion attempts, such as those against the Senate in March 2026, were unsuccessful, the group provided services to clients including China’s Ministry of State Security and the People’s Liberation Army.
Entities
China · Department of Justice · FBI · Federal Bureau of Investigation · Federal Reserve · Ministry of State Security · NASA · Nanjing Xinjiuwei Network Technology Company · People's Liberation Army · QTFY · U.S. Department of Justice · U.S. Senate
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 7 SOURCES] Targets of the hacking include US military networks, hospitals, power companies, and defense contractors. keyt.com · krdo.com · kvia.com · otvoreno.me · abc17news.com · +2 more
- [● 5 SOURCES] China has denied the allegations of cyber-espionage. keyt.com · krdo.com · kvia.com · otvoreno.me · abc17news.com
- [● 17 SOURCES] The Justice Department seized three internet domains affiliated with a Chinese tech company used in the campaign. keyt.com · krdo.com · kvia.com · otvoreno.me · abc17news.com · +12 more
- [● 26 SOURCES] Compromised agencies include NASA, the Federal Reserve, the Department of Justice, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and the U.S keyt.com · krdo.com · kvia.com · otvoreno.me · www.news20.ro · +20 more
- [● 41 SOURCES] US officials allege a major Chinese cyber-espionage campaign has compromised numerous federal agencies. keyt.com · krdo.com · kvia.com · otvoreno.me · www.news20.ro · +36 more
- [● 41 SOURCES] Hackers affiliated with Chinese military and intelligence services allegedly used a Chinese tech company to obscure their activities. keyt.com · krdo.com · kvia.com · otvoreno.me · abc17news.com · +36 more
- [● 35 SOURCES] The group provided hacking services to China’s Ministry of State Security and the People’s Liberation Army. pelop.gr · www.tanea.gr · www.reporter.gr · www.lykavitos.gr · www.sofokleousin.gr · +30 more
- [● 36 SOURCES] The U.S. Department of Energy, Department of Health and Human Services, and the National Institutes of Health were targeted. www.reporter.gr · pelop.gr · www.tanea.gr · www.lykavitos.gr · www.sofokleousin.gr · +31 more
- [● 39 SOURCES] Authorities seized domains associated with the QScan and QTRouter hacking platforms. www.reporter.gr · pelop.gr · www.tanea.gr · www.lykavitos.gr · www.sofokleousin.gr · +34 more
- [● 36 SOURCES] The hacking infrastructure had been active since at least 2018. www.reporter.gr · pelop.gr · www.tanea.gr · www.lykavitos.gr · www.sofokleousin.gr · +31 more
- [● 38 SOURCES] The U.S. Department of Justice and FBI seized three internet domains supporting two hacking platforms, QScan and QTRouter. www.reporter.gr · pelop.gr · www.tanea.gr · www.lykavitos.gr · www.sofokleousin.gr · +33 more
- [● 34 SOURCES] Targets included NASA, the Federal Reserve, and the U.S. Senate. www.reporter.gr · pelop.gr · www.tanea.gr · www.lykavitos.gr · www.sofokleousin.gr · +29 more