Chinese state-sponsored hackers successfully infiltrated numerous U.S. government computer systems, including those at NASA and the Department of Justice, according to an FBI affidavit. Federal authorities announced the seizure of three web domains associated with the hacking group QTFY, which had been used to compromise critical infrastructure and sensitive networks.
The breaches occurred between 2018 and 2026, targeting agencies such as the National Institutes of Health, the Department of Health and Human Services, three Department of Energy National Laboratories, the Federal Reserve, and the U.S. Senate. The affidavit also indicated that the hackers targeted hospital systems and healthcare centers.
QTFY sold its hacking services, known as "QScan" and "QTRouter," to China's Ministry of State Security and the People's Liberation Army through a private company named Nanjing Xinjiuwei Network Technology Co. These services were capable of infecting thousands of devices globally, with documented instances including a medical center in Ohio, financial groups in Michigan and South Korea, and an insurance agency in Missouri.
Attorney General Todd Blanche stated that state-sponsored hackers targeting American critical infrastructure will face prosecution. FBI Director Kash Patel added that the disruption of this global botnet and hacking platform was a significant technical operation against China-sponsored hacking activities, aligning with President Trump's Cyber Strategy for America. The FBI is intensifying efforts to counter adversary behavior and defend the homeland in cyberspace.