The United States announced on Wednesday that it had disrupted a Chinese hacking operation that targeted several sensitive government agencies, including the U.S. Justice Department, NASA, the Federal Reserve, and the Senate. The U.S. Justice Department disclosed that it had taken control of domains used by two hacking platforms known as “QScan” and “QTRouter,” which were part of the cyber campaign. An affidavit revealed that the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four undisclosed companies in the U.S. and South Korea were among the victims of the hackers.
The Chinese Embassy in Washington did not respond immediately to requests for comments, as China typically denies involvement in hacking activities. The Justice Department identified Nanjing Xinjiuwei Network Technology Company as the operator of the platforms, stating that its clients included China’s Ministry of State Security and the People’s Liberation Army. Nanjing Xinjiuwei did not provide an immediate response to inquiries.
The affidavit mentioned that the group’s computer infrastructure had been used to breach critical infrastructure and sensitive networks in the U.S. and globally since at least 2018. The hackers attempted to access NASA networks in August 2019 through a virtual private network vulnerability. In September 2024, they infiltrated three Energy Department laboratories, the NIH, an undisclosed HHS agency, and a U.S. security device manufacturer.
The agencies and government organizations identified as targets by the Justice Department did not respond immediately to requests for comments. Chinese-affiliated hacking campaigns have compromised several U.S. government and private networks in recent years. The FBI informed Congress in March about hackers breaching certain agency networks related to individuals under FBI investigation, with subsequent reports linking the intrusion to China. Chinese-linked hackers have also been associated with breaches in U.S. House of Representatives committee networks and multiple major telecommunications companies.
Experts monitoring Chinese cyber activities suggest that private contractors often conduct high-profile intrusions on behalf of various Chinese government agencies. Dakota Cary, a China analyst at cybersecurity firm SentinelOne, noted a significant increase in companies offering specialized offensive services over the past decade.
