US claims Chinese hackers breached Justice Department, Federal Reserve, NASA in lengthy threat campaign

US government officials have revealed that Chinese state-sponsored hackers breached a host of federal institutions as part of a recent espionage campaign.

In a statement, the US Justice Department and FBI confirmed it has successfully seized domains used to support two hacking platforms known as ‘QScan’ and ‘QTRouter’.

These platforms were used by a state-sponsored group known as ‘QTFY’ to target critical infrastructure and “other sensitive networks”.

According to the FBI, the group successfully breached NASA, the Federal Reserve, Department of Energy, the US Senate, Department of Justice, and other agencies.

The scope and nature of the breaches has not been revealed.

“Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China,” said Attorney General Todd Blanche.

“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise.”

State-backed operators

The QTFY group provides hacker-for-hire services to paying customers, as well as the People’s Republic of China’s (PRC) Ministry of State Security and the People’s Liberation Army (PLA), according to court documents.

QScan and QTRouter are frequently-used platforms in QTFY operations, according to the Justice Department. The first of these is used to scan for and automatically infect vulnerable IoT devices, which are then added to the broader QTRouter network of controlled devices.

“QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers,” the Justice Department noted.

QTRouter serves as an "obfuscation network" for the group, meaning that it enables QTFY and other "malicious cyber actors" to conceal their location and activities.

Officials noted that the seized domains were hard-coded into both QScan and QTRouter malware, which were then used in follow-up attacks against US government agencies.

Disrupting cyber threats

The takedown announced by the Justice Department marks the latest in a string of operations aimed at mitigating Chinese state-backed threats.

In 2025, for example, the FBI helped remove the PlugX surveillance malware from more than 4,000 computers across the US following a campaign conducted by the Mustang Panda group.

That operation came just months after a similar sting that crippled a botnet hosted by the Flax Typhoon hacker group.

“These tools were used by PRC cyber actors to hide the origin of their attacks,” said FBI Director Kash Patel.

“Thanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.