US Authorities Disrupt China-Linked Hacking Network Targeting Critical Infrastructure and Federal Agencies

In a major joint operation, the United States Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) unsealed court documents announcing the disruption of a sprawling state-sponsored cyber-espionage network based in China. Federal law enforcement officials obtained court orders to seize key internet domains powering two sophisticated hacking platforms, known as "QScan" and "QTRouter." According to investigative filings from the Southern District of California, the malicious platforms were operated by a Chinese state-linked threat group tracked as "QTFY," which worked in coordination with Nanjing Xinjiuwei Network Technology Company. Since at least 2018, QTFY used QScan to scan the internet for vulnerable Internet-of-Things (IoT) devices and automatically infect them. The infected devices were then funneled into QTRouter, an obfuscation network designed to route malicious traffic through compromised consumer devices, effectively masking the origin of the cyberattacks. The seized infrastructure was actively utilized to target critical U.S. government entities and sensitive infrastructure sectors, including NASA, the Federal Reserve, the Department of Energy, the U.S. Senate, and various healthcare and telecommunications systems. Because the seized domains were hardcoded directly into the attackers' malware for authentication and command communication, the court-ordered seizures rendered both QScan and QTRouter completely inoperable worldwide. Alongside the enforcement action, the FBI, National Security Agency (NSA), and Cyber National Mission Force issued a joint cybersecurity advisory warning critical infrastructure operators to patch edge devices and monitor for indicators of compromise. Officials stressed that foreign state-sponsored cyber threats to critical infrastructure remain a serious ongoing challenge for global security.