The United States announced on Wednesday that it had disrupted a Chinese cyber-attack operation targeting the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and other sensitive government entities. The U.S. Justice Department confirmed the seizure of domains used by two hacking platforms known as “QScan” and “QTRouter,” which were part of the hacking campaign. The operation targeted organizations including the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four undisclosed companies in the U.S. and South Korea.
The Chinese Embassy in Washington did not respond immediately to requests for comments, as Beijing typically denies involvement in hacking activities. The Justice Department revealed that the hacking platforms were operated by Nanjing Xinjiuwei Network Technology Company, a China-based firm whose clients included China’s Ministry of State Security and the People’s Liberation Army.
The affidavit disclosed that the cyber group’s infrastructure had been used to compromise critical networks globally since at least 2018. The hackers attempted to breach NASA networks in August 2019 through a virtual private network vulnerability, and in September 2024, they infiltrated Energy Department laboratories, the NIH, an HHS agency, and a U.S. security device manufacturer.
Government agencies named as targets by the Justice Department did not immediately respond to requests for comments. Recent years have seen Chinese-linked hacking campaigns infiltrating sensitive U.S. government and private networks. In a related development, the FBI informed Congress in March about cyber intrusions into agency networks related to individuals under investigation, with subsequent reports attributing the attacks to China. Chinese hackers have also been linked to breaches of U.S. House of Representatives committee networks and major telecommunications companies.
Experts monitoring Chinese cyber activities suggest that private contractors are frequently engaged in high-profile cyber intrusions on behalf of various Chinese government agencies. Dakota Cary, a China analyst at SentinelOne cybersecurity company, noted a significant rise in companies providing specialized offensive services over the past decade.