US Disrupts Chinese Botnet Targeting Federal Agencies and Infrastructure

The United States Department of Justice and the Federal Bureau of Investigation disrupted a global botnet and hacking platform used by Chinese state-sponsored actors to target U.S. critical infrastructure and federal systems. The operation seized internet domains supporting QScan, a vulnerability scanning tool, and QTRouter, an obfuscation network. These tools were operated by a hacking group known as QTFY, which is employed by the Nanjing Xinjiuwei Network Technology Company.

U.S. officials allege that Nanjing Xinjiuwei acted as a private contractor for the Ministry of State Security of the People's Republic of China and the People's Liberation Army, employing retired army personnel to mask hacking activity within routine consumer internet traffic. The campaign compromised numerous federal entities, including NASA, the Federal Reserve, the U.S. Senate, and the departments of Justice, Energy, and Health and Human Services, as well as the National Institutes of Health. The group also targeted hospitals, power companies, defense contractors, and four companies in South Korea.

While some attempts dating back to 2018 failed, infiltrations into the Department of Energy and the National Institutes of Health in 2024 were successful. In response to the discovery, the FBI and National Security Agency issued a cybersecurity advisory to help organizations detect QTFY activity. Attorney General Todd Blanche stated that the U.S. has discussed these activities with Chinese counterparts for years and asserted that the activity "has to stop."