The US Justice Department and FBI on August 26 disrupted two Chinese hacking platforms, QScan and QTRouter, by seizing three domains controlling their operations, according to multiple sources [1, 2, 3].
The platforms were operated by Nanjing Xinjiuwei Network Technology Company, which works for China’s Ministry of State Security and the People's Liberation Army [1, 2, 4]. The hacking group behind the campaigns, identified as QTFY, is a state-sponsored organization that offers hacking services for pay [2, 4].
Victims included major US government agencies: NASA, the Federal Reserve, Department of Justice, US Senate, Department of Energy, Health and Human Services, and the National Institutes of Health [1, 2, 4]. Beyond government, the hackers targeted hospitals, telecommunications providers, power companies, financial institutions, and defense contractors [1, 2, 4].
The platforms scanned more than 2 million infected internet-connected devices—such as routers and other IoT endpoints—in a single day during their operations in 2024. These compromised devices were aggregated into a botnet to obfuscate the origins of attacks [5, 6]. FBI Director Kash Patel said, "These tools were used by Chinese government-supported cyber actors to obfuscate attack sources, and we have seized the infrastructure and shut down the platforms" [6].
The hacking campaign dates to at least 2018, when the QTFY group began targeting US and global critical infrastructure. In August 2019, QTFY made an unsuccessful attempt to hack NASA, which was thwarted by patched vulnerabilities [7, 3]. Court documents revealed successful breaches in 2024 of Department of Energy laboratories, NIH, Health and Human Services, and a US security-device manufacturer [7]. FBI had previously disrupted a related large IoT botnet used in China-backed cyberattacks that year [6].
US Attorney General Todd Blanche stated, "State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted." He added, "Federal law enforcement investigated and disabled [China’s] malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China [PRC]" [2].
Cybersecurity analyst Dakota Cary commented, "Over the last decade, the number of companies offering niche offensive services has exploded," highlighting the growing challenge of state-sponsored cyber threats [1].
The court-authorized seizure of these three domains aims to disable the hacking infrastructure operated by the Chinese state-sponsored group. Law enforcement officials have not announced further planned operations but are expected to continue monitoring and disrupting related threats.
