US Disrupts China-Linked Cyber Operation Targeting Sensitive Government Networks
The United States has disrupted a sophisticated cyber operation that American authorities say was linked to Chinese state interests and had targeted several highly sensitive government institutions, including NASA, the Federal Reserve, the Justice Department and the US Senate.
The US Department of Justice announced that authorities had seized internet domains associated with two hacking platforms known as QScan and QTRouter. Officials said the platforms were used to identify vulnerable internet-connected devices and conceal the origins of cyber intrusions.
According to court documents made public in connection with the operation, the activity had been underway for years. Investigators said the hacking infrastructure had been used since at least 2018 and was connected to a China-based company identified as Nanjing Xinjiuwei Network Technology Company.
The alleged operation was broader than attacks against government agencies. US authorities said the network was also associated with attempts to compromise organizations and businesses in sectors including healthcare, telecommunications, energy, finance and defense. Investigators reported activity involving targets in more than 130 countries.
One of the key components, QScan, was allegedly designed to search the internet for vulnerable devices and compromise them. Those infected machines could then become part of a larger network that attackers could use to route malicious traffic.
QTRouter allegedly served a different but equally important purpose: helping cyber operators hide where their attacks originated. By sending traffic through previously compromised devices, attackers could make malicious activity appear to come from locations unrelated to the actual operators.
US investigators said the platforms were connected to a group referred to as QTFY. The Justice Department alleges that the organization provided hacking-related services to customers associated with China’s intelligence and military establishments. These claims form part of the US government’s broader accusations concerning Chinese state-backed cyber activity.
NASA was reportedly among the organizations targeted during the campaign. Investigators also identified the Federal Reserve, the Senate and several federal departments among the institutions affected or targeted by the operation. The FBI said it had been investigating elements of the activity for years.
The US government says the seizure of the relevant domains disrupted the hacking platforms because those domains were important to their communication and authentication systems. Authorities therefore described the action as a technical effort to make the infrastructure inoperable rather than simply issuing a warning about the alleged activity.
The case also illustrates the growing complexity of modern cyber threats. Attackers can exploit ordinary internet-connected equipment, build networks of compromised devices and use layers of digital infrastructure to make attribution more difficult.
China has rejected the US allegations. Beijing has accused Washington of using cybersecurity claims to portray Chinese companies negatively and impose restrictions on them.
The latest US action adds to a series of American efforts to dismantle cyber infrastructure that officials associate with Chinese government-backed hacking groups. It also reflects the increasing importance of cybersecurity in relations between Washington and Beijing.
For governments and businesses around the world, the incident serves as another reminder that internet-connected devices can become part of large-scale cyber operations if they are not properly protected. Security specialists continue to emphasize timely software updates, stronger authentication, network monitoring and rapid response to suspicious activity.
The investigation remains significant because the alleged campaign extended well beyond a single institution or country. With government agencies, critical industries and organizations across multiple nations reportedly targeted, the case highlights how cyber espionage has become an international security challenge requiring cooperation between law-enforcement and cybersecurity agencies.
