US disrupts China-linked hacking platforms targeting agencies

The United States has disrupted a China-linked cyber operation blamed for intrusions into some of the country’s most sensitive government networks, including the Justice Department, NASA, the Federal Reserve and the US Senate.

Federal authorities on Wednesday seized internet domains supporting two hacking platforms, QScan and QTRouter, which investigators say were used to penetrate government agencies, critical infrastructure and corporate networks. The action effectively disabled key parts of the platforms by cutting them off from domains hard-coded into the malicious software for communications and authentication.

The operation was attributed to a state-sponsored hacking group known as QTFY. US authorities said the group was employed by Nanjing Xinjiuwei Network Technology Company, a China-based technology business accused of supplying cyber capabilities to clients that included the Ministry of State Security and the People’s Liberation Army.

Victims of the intrusion activity included the Department of Energy, Department of Health and Human Services and National Institutes of Health, alongside NASA, the Federal Reserve, Justice Department and Senate. Four unidentified companies in the United States and South Korea were also identified as targets.

Investigators said infrastructure connected with the group had been used against critical and sensitive networks in the United States and elsewhere since at least 2018. The length of the campaign underscores concerns in Washington that cyber espionage operations linked to China are increasingly being sustained through specialised private companies rather than conducted solely by government personnel.

QScan and QTRouter performed complementary roles. The tools helped operators identify vulnerable systems, manage compromised devices and maintain infrastructure required for further intrusions. By seizing the domains on which the platforms depended, authorities said they deprived operators of essential functions and rendered the systems unusable in their existing configuration.

The campaign adds to a series of confrontations between Washington and Beijing over cyber espionage. US officials have repeatedly accused China-linked groups of targeting telecommunications networks, government agencies, technology companies and infrastructure operators. Beijing has consistently rejected accusations that it sponsors hacking operations and has, in turn, accused Washington of conducting cyber surveillance against China.

A growing commercial ecosystem surrounding offensive cyber operations has complicated attribution. Security researchers have tracked an expanding number of technology contractors offering specialised services ranging from vulnerability discovery to network exploitation and malware development. Some companies can operate for government customers while retaining the structure and appearance of ordinary private businesses.

Nanjing Xinjiuwei is alleged to have operated within that model. Court documents described connections between the company and China’s intelligence and military establishment, placing the firm within a broader network of contractors suspected of providing technical capabilities for state-directed cyber operations.

The action against QTFY follows earlier US operations against hacking infrastructure linked to China. Federal authorities in 2025 removed PlugX surveillance malware from more than 4,000 computers after infections attributed to the Mustang Panda group. A year earlier, authorities dismantled a botnet made up of hundreds of thousands of internet-connected devices that had been associated with infrastructure used by the group known as Flax Typhoon.

Another disruption in 2023 targeted a botnet connected to Volt Typhoon, a hacking operation that drew particular attention because of its focus on communications, energy, transportation and other critical infrastructure. US security agencies warned that access to such networks could potentially be used to disrupt essential services during a geopolitical crisis.

The newly disclosed operation differs in its breadth, with targets spanning scientific research, monetary institutions, healthcare bodies, energy agencies and the legislative branch. The inclusion of the Federal Reserve is particularly sensitive because of the institution’s role in monetary policy and its access to market-moving economic information.

NASA and the Department of Energy also maintain networks containing valuable scientific and technological data, while the National Institutes of Health possesses extensive biomedical research information. Such institutions have long been attractive intelligence targets because stolen research can have strategic, commercial and military applications.