The U.S. government has moved to dismantle a broad Chinese state-backed hacking campaign that infiltrated major federal networks, the Justice Department announced Wednesday — including systems tied to the department itself.
In a statement, DOJ officials said authorities seized two internet domains allegedly used by the hackers, known as “QScan” and “QTRouter,” to probe and target U.S. critical infrastructure as well as sensitive federal government networks.
Federal prosecutors said the China-linked operators compromised networks belonging to a range of high-profile institutions, including the Federal Reserve, NASA and the U.S. Senate.
The Department of Energy, the Department of Health and Human Services, and the National Institutes of Health were also among the victims, prosecutors said, along with four unidentified companies based in the United States and South Korea.
“Other targeted networks include those operated by hospitals, telecommunications providers, power companies, financial institutions, and defense contractors,” Justice Department officials said in a court filing.
According to an affidavit filed in federal court, the hacking infrastructure was operated by a Chinese state-sponsored group identified as “QTFY,” whose paying customers allegedly include China’s Ministry of State Security — the country’s civilian intelligence service — and the People’s Liberation Army.
Prosecutors said the PRC-aligned group had been attempting to penetrate U.S. critical infrastructure and sensitive government agencies since at least 2018, highlighting both the persistence of state-sponsored cyber operations and the increasingly advanced methods hackers use to gain access while quickly masking their origins.
Attorney General Todd Blanche and FBI Director Kash Patel address reporters in Washington, D.C.
President Donald Trump greets Chinese President Xi Jinping ahead of a bilateral meeting. Xi Jinping is slated to travel to Washington, DC, to meet with Trump in September
The J. Edgar Hoover Federal Bureau of Investigation building and the US Department of Justice building are seen in Washington, DC
QScan, for example, offered customers the ability to scan for and ‘automatically infect’ thousands of IoT, or internet-of-things devices. IoT devices, in layman’s terms, include any appliance or device that hooks up to the internet, such as smart TVs, internet-linked speakers, or even security cameras and smart refrigerators.
From there, QScan would add the infected devices to the QTRouter, which served as an obfuscation network – allowing the Chinese-linked firm QTFY and other malicious hackers to cover their tracks and their origin from within the People’s Republic of China.
‘State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,’ Attorney General Todd Blanche said in a press release announcing the disruption.
‘Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China.’
The news comes as President Donald Trump and Chinese President Xi Jinping are slated to have another bilateral meeting in DC this September, following the Trump’s trip to China in May.
And it comes as the DOJ and FBI have worked in concert for years to crack down on state-sponsored hacking operations, including sophisticated operations with ties to Russia or China.
‘The FBI remains relentless in our efforts to counter nation state cyber actors, taking decisive action against those threatening the United States and our critical infrastructure,’ said Special Agent in Charge Mark Remily of the FBI San Diego Field Office.
‘Through complex investigations, aggressive technical operations, and strong partnerships, FBI San Diego will continue to identify, disrupt, and impose costs on our cyber adversaries. We are committed to dismantling the tools behind these state-sponsored crimes and protecting the American people from malicious cyber activity.’
