The United States announced on Wednesday that it has disrupted a Chinese cyberattack operation targeting the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and other sensitive government entities. The U.S. Justice Department revealed that it had taken control of domains utilized by two hacking platforms named “QScan” and “QTRouter,” which were part of the cyber campaign. An affidavit listed the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four unnamed American and South Korean companies as victims of the hackers.
While the Chinese Embassy in Washington did not respond to requests for comment, the Justice Department disclosed that the hacking platforms were operated by the Nanjing Xinjiuwei Network Technology Company in China. This company reportedly served clients such as China’s Ministry of State Security and the People’s Liberation Army. Nanjing Xinjiuwei has not provided an immediate response to the inquiries.
According to the affidavit, the cyber group’s infrastructure was used to breach critical infrastructure and sensitive networks within the U.S. and globally since at least 2018. The hackers attempted to access NASA networks in August 2019 through a virtual private network vulnerability, and later intruded into Energy Department laboratories, the NIH, an unnamed HHS agency, and a U.S. security device manufacturer in September 2024.
The targeted agencies and organizations have not commented on the matter. Over the years, Chinese-linked hacking operations have compromised several U.S. government and private networks. The FBI previously informed Congress about hackers infiltrating specific agency networks related to FBI investigations, with subsequent reports linking the breach to China. Chinese hackers have also been associated with compromising U.S. House of Representatives committee networks and telecommunications companies.
Experts tracking Chinese cyber activities note that private contractors frequently conduct significant intrusions on behalf of various Chinese governmental bodies. Dakota Cary, a China analyst at cybersecurity firm SentinelOne, highlighted the rise in companies offering specialized offensive services in the past decade.