The United States announced on Wednesday that it had disrupted a Chinese cyberattack operation that targeted the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and other sensitive government entities. The U.S. Justice Department disclosed that it had taken control of domains associated with two hacking platforms known as “QScan” and “QTRouter,” which were utilized in the attack campaign.
According to an affidavit, the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four undisclosed companies in the U.S. and South Korea were among the victims of the hackers. The Chinese Embassy in Washington did not respond to requests for comments, as China typically denies involvement in hacking activities.
The Justice Department revealed that the hacking platforms were operated by the Nanjing Xinjiuwei Network Technology Company, a China-based firm with clients including China’s Ministry of State Security and the People’s Liberation Army. Nanjing Xinjiuwei has not yet provided a response to the allegations.
The affidavit detailed that the hacking group’s infrastructure had been used to breach critical infrastructure and sensitive networks in the U.S. and globally since at least 2018. The hackers attempted to infiltrate NASA networks in August 2019 but were unsuccessful. In September 2024, intrusions were carried out at Energy Department laboratories, the NIH, an HHS agency, and a U.S. security device manufacturer, as per the affidavit.
The affected agencies and organizations identified by the Justice Department did not immediately comment on the situation. Recent years have seen Chinese-linked hacking campaigns compromising various U.S. government and private networks. The FBI previously informed Congress about hacking incidents targeting agency networks related to individuals under investigation, which were later attributed to China.
Chinese-linked hackers have also been connected to breaches in U.S. House of Representatives committee networks and major telecommunications companies. Experts monitoring Chinese cyber activities suggest that private contractors frequently conduct high-profile intrusions on behalf of Chinese government agencies.
Dakota Cary, a China analyst at cybersecurity company SentinelOne, noted the rise in companies offering specialized offensive services over the past decade.