The Justice Department and FBI have disrupted a sophisticated cyber operation linked to China that targeted sensitive U.S. networks, including NASA, the Federal Reserve, and other government agencies, since at least 2018. The operation utilized tools named QScan and QTRouter, designed to compromise internet-connected devices and mask the origin of malicious traffic.
According to federal authorities, the group behind the operation, known as QTFY, worked for Nanjing Xinjiuwei Network Technology Company in China. The Justice Department alleges that this company provided hacking services to entities including China's Ministry of State Security and the People's Liberation Army.
Investigators stated that the QTFY infrastructure was used to breach critical infrastructure and sensitive networks. Targets reportedly included government agencies, four unnamed companies in the United States and South Korea, hospitals, telecommunications providers, financial institutions, and defense contractors.
How the Hacking Operation Worked
QScan was described as a scanning tool that identified and infected vulnerable internet-of-things (IoT) devices globally. These compromised devices then became part of QTRouter, an obfuscation network that disguised the true origin of cyberattacks. This network consisted of compromised IoT devices, commercial proxy devices, and leased virtual private servers.
By routing malicious communications through this network, attackers could make their activities appear to originate from outside China or even from proximity to the targeted network. FBI Director Kash Patel emphasized that these tools were used by "PRC cyber actors to hide the origin of their attacks."
NASA, when contacted for comment, stated its commitment to cybersecurity and protecting its systems, noting close collaboration with federal partners and continuous monitoring for potential risks. The Chinese Embassy in Washington stated it was unaware of the specifics but asserted China's firm opposition to cyberattacks and urged the U.S. to cease discrediting China over cybersecurity issues.
Dismantling the Operation
Federal agents were able to shut down the operation by obtaining court authorization to seize domains essential to QScan and QTRouter's functionality. These domains were hard-coded into the malware for communication and authentication. Once seized, the Justice Department reported that the QScan and QTRouter platforms became inoperable.
This action is part of a broader pattern of U.S. efforts to counter China-linked cyber operations. Previous disruptions include the FBI's removal of PlugX surveillance malware from U.S. computers infected by the Mustang Panda group in 2025, and the disabling of a botnet associated with Flax Typhoon in 2024.
Protecting Connected Devices
While individuals cannot stop nation-state hacking operations, they can take steps to secure their own connected devices. Experts recommend regularly updating router firmware, replacing routers that no longer receive security updates, and changing default administrator passwords. Using strong, unique passwords for both router administration and Wi-Fi networks, along with employing WPA3 encryption when available, is also advised.
Security experts also suggest disabling remote administration unless specifically needed, turning off WPS and unnecessary UPnP access, and ensuring the router's firewall is enabled. For enhanced security, users can place smart devices on a separate guest or IoT network and ensure these devices also receive regular software updates. Changing default passwords on all connected devices and regularly reviewing the list of devices connected to a Wi-Fi network are also recommended steps. Devices no longer in use should be removed from the network and disconnected.