The U.S. says a China-linked hacking operation broke into or targeted systems at NASA, the Federal Reserve, the Justice Department, the Senate, and other sensitive networks, then hid activity by routing traffic through a large botnet of compromised internet-connected devices. Authorities say they disrupted the operation by seizing domains tied to two hacking platforms, QScan and QTRouter.
According to court filings cited by U.S. media, the campaign dates back to at least 2018 and extended across government agencies, hospitals, telecom firms, power companies, financial institutions, and defense contractors. The filings also list the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health among the victims or targets.
Investigators say the group behind the activity was identified as QTFY, which was allegedly employed by the China-based Nanjing Xinjiuwei Network Technology Company. The DOJ says QTFY created and operated the two platforms to help customers infiltrate networks and cover their tracks. Reports say the services functioned as a paid hacking model, with QScan and QTRouter scanning for vulnerable devices, infecting them, and turning them into proxy nodes.
The technical method was especially concerning because it relied on IoT devices that were easier to compromise than hardened corporate systems. By spreading traffic through those devices, the attackers could make malicious connections look ordinary and make attribution more difficult. U.S. officials said that tactic allowed the hackers to quietly reach into sensitive networks while reducing the chance of immediate detection.
The case also shows how cyber operations can blend state interests, commercial tooling, and infrastructure abuse into one long-running campaign. Officials described the seizure as part of a wider push to disrupt Chinese-linked hacking against U.S. government systems and critical infrastructure. For security teams, the key lesson is that even well-defended institutions can be exposed when attackers use botnets, proxy layers, and broad scanning to find weak entry points.
