Chinese hackers broke into Justice Department, NASA, Federal Reserve, Senate. DOJ says they were ‘PRC sponsored cybercriminals’

The U.S. government announced on Wednesday that it has successfully disrupted a sophisticated Chinese hacking operation. This campaign, which targeted some of the most sensitive entities in the country, including the Justice Department, NASA, the Federal Reserve, and the Senate, relied on a pair of specialized hacking platforms known as QScan and QTRouter. By seizing the domains associated with these tools, federal authorities have effectively rendered them inoperable, marking a significant victory in the ongoing battle against foreign cyber threats.

As reported by Reuters, the operation was masterminded by a group known as QTFY, which the Justice Department identified as a state-sponsored entity operating out of China. This group was employed by the Nanjing Xinjiuwei Network Technology Company, a firm that provided hacking services to high-level clients, including the Chinese military, the People’s Liberation Army, and the Ministry of State Security.

The DOJ has established a clear link between Chinese private sector contractors and state intelligence agencies, but it’s a trend that experts have been tracking for a long time. Dakota Cary, a China analyst with SentinelOne, noted that over the last decade, the number of companies offering niche offensive services has exploded.

The list of victims is extensive and highlights the breadth of their ambition

Court documents and a joint advisory from the FBI, NSA, and U.S. Cyber Command reveal that the hackers were active as far back as 2018. Their methods were designed to be both invasive and difficult to trace. QScan was used to automatically infect thousands of internet-of-things devices across the globe.

These infected devices were then funneled into the QTRouter network, which acted as an obfuscation layer. By routing their traffic through these compromised devices, the hackers could make their malicious activity appear as if it were coming from locations outside of China, sometimes even from within the very networks they were trying to infiltrate.

In addition to the government agencies already mentioned, the affidavit lists the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health. Private companies in the U.S. and South Korea were also caught in the crosshairs. While not every attempt was successful, the persistent nature of these attacks is concerning.

For example, the hackers unsuccessfully tried to crack NASA networks back in August 2019 by targeting a virtual private network vulnerability. Fast forward to September 2024, and they were busy carrying out intrusions at three different Department of Energy laboratories, the NIH, and a U.S. security device manufacturer.

Even as recently as March 2026, the group was still scanning for vulnerabilities, making unsuccessful attempts to breach the U.S. Senate and a hospital. It’s a constant game of cat and mouse. Attorney General Todd Blanche stated, “State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise.”

FBI Director Kash Patel added that the operation was part of a broader effort to support President Trump’s Cyber Strategy for America, aiming to shape adversary behavior and defend the homeland in cyberspace.

The Chinese government has pushed back against these allegations. A spokesperson for the Chinese Embassy in Washington sent an email stating that the government firmly opposes and combats all forms of cyberattacks in accordance with the law. They further claimed that the U.S. uses cybersecurity issues to smear or discredit China and that the country opposes the U.S. overstretching the concept of national security to impose discriminatory restrictions on Chinese companies.

Despite these protests, this isn’t the first time the FBI has taken such decisive action. The agency has been on a roll with these technical operations. In 2023, they disrupted the Volt Typhoon group, and in 2024, they took down a massive botnet linked to Flax Typhoon.