The U.S. Justice Department and FBI announced on August 26, 2026, the disruption of a Chinese-backed hacking operation that targeted multiple U.S. government agencies, including the Justice Department, NASA, the Federal Reserve, and the U.S. Senate [1, 2, 3]. Authorities seized two hacking platforms known as QScan and QTRouter through court-authorized domain seizures, effectively shutting down tools used to infiltrate sensitive networks [1, 4, 2, 3].

The two platforms are operated by the Nanjing Xinjiuwei (New Jiwei) Network Technology Company in China. This firm counts China’s Ministry of State Security and the People’s Liberation Army among its clients, linking the cyber activities to both civilian intelligence and military agencies [1, 4, 2, 3].

Victims of the hacking intrusions include NASA, the Federal Reserve, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, the U.S. Senate, and several unnamed U.S. and South Korean companies [1, 4, 2, 3]. The hacking campaign dates back to at least 2018, when the QScan and QTRouter tools were first used to compromise critical infrastructure and sensitive networks globally [1, 4, 2, 3].

The campaign involved several notable attacks and attempts over recent years. In August 2019, hackers unsuccessfully tried to access NASA networks via a VPN vulnerability [4, 2, 3]. In May 2024, they reportedly stole data from a U.S. defense contractor, a financial institution, and a university [2, 3]. In September 2024, successful intrusions occurred at three Department of Energy laboratories, the NIH, an HHS agency, and a U.S. security device manufacturer [4, 2, 3]. Most recently, in March 2026, hackers attempted but failed to breach the U.S. Senate and a hospital’s network [2, 3].

The U.S. Justice Department stated, "Two hacking platforms, QScan and QTRouter, used by Chinese hackers, have been seized under court order to disrupt their cyberattacks on U.S. critical infrastructure and sensitive networks." FBI Director Kash Patel added that the FBI is intensifying efforts to "change adversary behavior and defend homeland networks in support of the U.S. President’s cyber strategy" [1].

The Chinese embassy denied knowledge or responsibility for the hacking and reiterated its position, stating, "中国政府坚决反对并依法打击一切形式的网络攻击。" (The Chinese government firmly opposes and lawfully combats all forms of cyberattacks) [4, 2, 3].

Security experts have noted a rise in private Chinese firms providing offensive cyber services on behalf of state agencies over the past decade [1, 4, 3].

The Justice Department and FBI have completed the domain seizures of QScan and QTRouter and continue investigations into the full scope of affected networks and companies [1, 2, 3].