The Justice Department and FBI say they have shut down a hacking platform that Chinese state-sponsored hackers used for years to hide attacks on U.S. targets, including government agencies, hospitals, telecom providers, power companies and defense contractors. Prosecutors seized three internet domains tied to Nanjing Xinjiuwei Network Technology Company, the China-based firm behind a group known as QTFY, according to the Justice Department.
“These tools were used by PRC cyber actors to hide the origin of their attacks,” FBI Director Kash Patel said. “Thanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down.”
Hacking as a service
According to court documents, QTFY, which includes former members of China’s military, sold hacking services to paying customers including China’s Ministry of State Security and the People’s Liberation Army. Two of those services worked together. QScan automatically scanned for and infected thousands of internet-of-things devices worldwide. QTRouter combined those devices with commercial proxy services and leased virtual private servers into an “obfuscation network,” so malicious traffic appeared to come from computers outside China, sometimes even local to the targeted network.
The seized domains were hard-coded into both tools and used for communication and authentication, so taking them made QScan and QTRouter inoperable. The FBI and NSA also published an advisory with indicators of compromise covering QTFY activity back to at least 2018, and Lumen’s Black Lotus Labs released an analysis of the group’s tactics.
The targets
Officials said the group targeted hundreds of U.S. entities, among them NASA, the National Institutes of Health, the Department of Health and Human Services, the Justice Department, the Department of Energy, the U.S. Senate and the Federal Reserve, ABC News reported. The seizure warrant says QTFY hackers broke into three Energy Department laboratories, NIH, an HHS agency and an unnamed U.S. security device maker in September 2024. They also tried to hack NASA in 2019, though court documents don’t indicate that attempt succeeded, and they don’t make clear how far the group got into several of the other agencies named.
The action is the latest in a series of court-authorized operations against Chinese hacking infrastructure. It follows the FBI’s removal of PlugX malware from more than 4,000 U.S. computers in 2025, its takedown of a Flax Typhoon botnet of hundreds of thousands of IoT devices in 2024, and its disruption of a Volt Typhoon botnet in 2023. For network defenders, the practical step is to check the FBI-NSA indicators against their logs and to replace or patch exposed IoT gear, the kind of devices QScan was built to take over.
WebProNews is an iEntry Publication