US Disrupts Chinese Hacking Operation Targeting Key Agencies

The United States has disrupted a China-affiliated hacking operation responsible for breaches at several high-profile government agencies, including the U.S. Justice Department, NASA, the Federal Reserve, and the U.S. Senate. According to multiple reports, the Justice Department seized domains used by two hacking platforms known as “QScan” and “QTRouter,” which were employed in the campaign.

The affected agencies also include the U.S. Department of Energy, the Department of Health and Human Services, and the National Institutes of Health. The hacking platforms are linked to a China-based firm, Nanjing Xinjiuwei Network Technology Company, which reportedly serves clients such as China’s Ministry of State Security and its military, the People’s Liberation Army.

The Justice Department stated that these platforms have been used since at least 2018 to compromise critical infrastructure and other sensitive networks in the U.S. and globally. The affidavit identified four unnamed companies in the United States and South Korea as additional victims of the hackers. Experts note that private contractors often carry out high-profile intrusions on behalf of various Chinese government agencies.

Attorney General Todd Blanche emphasized the severity of the threat, stating, “State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted.” This development comes amid growing congressional pressure to take a tougher stance against China ahead of President Xi Jinping’s visit to Washington.

According to Al Jazeera, hackers had unsuccessfully attempted to access NASA networks in August 2019. In September 2024, they successfully breached networks at three Department of Energy laboratories, NIH, HHS, and a U.S. security-device manufacturer, according to court documents.

QScan was used to find and infect thousands of internet-connected devices, including routers and other network equipment. Those devices were then incorporated into a network through QTRouter. This network allowed the hackers to route their attacks through computers and other devices outside China, making it appear as though the attacks originated from local or nearby devices.

The FBI emphasized its commitment to countering nation-state cyber actors and protecting critical infrastructure. The operation is part of a broader series of court-authorized actions targeting what Attorney General Todd Blanche described as “indiscriminate hacking activities” sponsored by China.