The FBI and Department of Justice seized three internet domains this week that powered a Chinese state-sponsored hacking operation responsible for stealing sensitive data from more than 300 organizations, including NASA, the Justice Department itself, the Federal Reserve, three Department of Energy national laboratories, and the National Institutes of Health, newly unsealed court records reveal.
The group, known as QTFY, operated through a China-based company that the FBI says sold hacking services directly to Beijing’s Ministry of State Security and the People’s Liberation Army. Former PLA members worked for the company and leveraged military relationships to secure contracts for offensive cyber operations against American targets.
Federal authorities said the domain seizures crippled both of QTFY’s main platforms, a mass-scanning tool called QScan and a traffic-routing system called QTRouter, by cutting off the domains used for core communications and authentication. Attorney General Todd Blanche framed the takedown in blunt terms.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted.”
The scale of the operation is difficult to overstate. On a single day in 2024, QScan processed more than two million scanning and penetration-testing tasks. The platform contained more than 200 proof-of-concept exploits, ready-made tools for breaking into networks. And the victim list reads like a directory of America’s most sensitive institutions.
The hacking campaign stretches back years. The New York Post reported that QTFY had been breaching U.S. government networks since 2018, operating through a private company identified as Nanjing Xinjiuwei Network Technology Co. That company functioned as a front, selling hacking-as-a-service to China’s intelligence and military apparatus.
As early as 2019, QTFY attempted to break into NASA using a vulnerability in the agency’s virtual private network. That particular attempt failed, NASA had already patched the flaw. But the group kept probing.
In March of an unspecified year, QTFY scanned Senate and hospital-system networks. In June, the group scanned a U.S. election system. Both attempts failed to gain access, but the targeting alone reveals Beijing’s appetite for intelligence on American democratic institutions and health infrastructure.
The real damage came in 2024. In May, QTFY exploited a recently disclosed vulnerability in Check Point security software while scanning U.S. power companies and telecommunications providers. That campaign yielded stolen data from more than 300 organizations in the United States and abroad, including defense contractors, financial institutions, and universities.
Four months later, approximately September 2024, the hackers exploited zero-day flaws in Ivanti Cloud Services Appliance software. That breach gave them access to three DOE national laboratories, the NIH, the Health Resources and Services Administration, and a U.S. security-device manufacturer. The joint advisory issued by the FBI, NSA, and Cyber National Mission Force did not disclose what information was accessed, how long the hackers remained inside those networks, or whether the breaches disrupted operations.
That silence is itself notable. When federal agencies won’t say what was taken from nuclear research laboratories and public health systems, the public deserves to wonder how deep the damage runs.
The group’s tradecraft was designed for stealth at scale. QTFY used QScan to identify vulnerable targets across the internet, then routed its malicious traffic through QTRouter, a network of compromised routers, cameras, and other internet-connected devices. By pushing attack traffic through devices physically near the victim’s own network, the hackers blended their operations with legitimate local traffic, making detection far harder.
It is a model that mirrors the kind of infrastructure-crippling cyberattacks that have hit American cities and emergency systems with increasing frequency.
Aaron Shraberg, senior intelligence team lead at cybersecurity firm Flashpoint, told Fox News Digital that QTFY fits a broader pattern in China’s cyber ecosystem.
“QTFY is another example of how China’s cyber ecosystem has blurred the line between commercial cybersecurity and state-sponsored operations. The commercialization of that ecosystem has helped turn capabilities that once relied on bespoke tradecraft into tools and services that can be developed, reused and deployed at scale.”
In other words, Beijing has industrialized hacking. What once required elite military hackers working on custom operations can now be purchased off the shelf from private contractors with PLA pedigrees and Ministry of State Security clients.
The QTFY takedown is the latest in a string of FBI operations targeting China-linked hacking groups. In 2023, the bureau disrupted a botnet used by Volt Typhoon, a group accused of concealing access to U.S. and foreign critical infrastructure. The following year, the FBI disabled a botnet made up of hundreds of thousands of infected internet-connected devices that another group, Flax Typhoon, had supplied to Chinese government customers.
And last year, the FBI removed PlugX surveillance malware from more than 4,000 U.S. computers infected by yet another Chinese group, Mustang Panda. The scope of Beijing’s cyber operations against the United States is not a matter of isolated incidents. It is a sustained, multi-front campaign.
FBI Director Kash Patel, as reported by the New York Post, connected the operation to the administration’s broader posture: “Today’s action is just the latest technical operation against PRC-sponsored hacking, and in support of President Trump’s Cyber Strategy for America, the FBI is surging efforts to shape adversary behavior and defend the homeland in cyberspace.”
The pattern of Chinese state-linked infiltration extends well beyond cyberspace. Federal authorities have also prosecuted local officials caught secretly serving as agents of the Chinese government, a reminder that Beijing’s intelligence operations target every level of American governance.
The Washington Examiner reported that Attorney General Blanche signaled the issue will be raised with Chinese leadership directly, adding: “This is something that we’ve talked about with our counterparts in China for many, many years. And we know that it’s happening. And they know we know that it’s happening. And it has to stop.”
Fox News Digital reached out to the Chinese embassy for comment. No response was reported.
The unsealed court records and joint advisory leave critical questions open. No arrests have been announced. The names of the three breached DOE national laboratories have not been disclosed. The identity of the compromised U.S. security-device manufacturer remains unknown. And the government has not said what data the hackers actually extracted from agencies responsible for nuclear research, public health, monetary policy, and national defense.
Large-scale data breaches, whether targeting private companies holding millions of customer records or federal agencies holding classified research, carry consequences that often take years to fully surface.
The federal government’s own recent prosecutions of foreign nationals tied to cyberattacks on U.S. water systems and critical infrastructure show the threat is not limited to one adversary. But no nation has matched the breadth, persistence, and institutional backing of China’s cyber campaign against the United States.
For years, Washington treated Chinese cyber intrusions as a diplomatic irritant, something to raise in summits and manage through strongly worded statements. Successive administrations talked while Beijing’s hackers walked through federal networks, stole research from national laboratories, and probed election systems.
The FBI’s domain seizures are a tangible step. Crippling QTFY’s infrastructure disrupts the group’s ability to operate in the near term. But the underlying problem, a Chinese government that has built an entire commercial ecosystem around hacking American institutions, will not be solved by seizing three domains.
The advisory’s refusal to disclose what was taken from DOE laboratories and the NIH should concern every taxpayer who funds those agencies. If the government cannot or will not tell the public what China stole from America’s nuclear and biomedical research facilities, the accountability gap is as wide as the security gap that let the hackers in.
Beijing has turned cyber espionage into a production line. Treating it like a series of one-off incidents is how you lose a war you never acknowledged was being fought.
By signing up, you agree to receive newsletters and promotional content from American Frontline News and selected publications in the American Digest Media Network, operated with Patriot Mom Digest LLC, and you accept our Terms of Use and Privacy Policy. You may unsubscribe at any time.
By signing up, you agree to receive newsletters and promotional content from American Frontline News and selected publications in the American Digest Media Network, operated with Patriot Mom Digest LLC, and you accept our Terms of Use and Privacy Policy. You may unsubscribe at any time.