The United States announced on Wednesday that it had disrupted a Chinese cyber-attack operation targeting key government agencies such as the U.S. Justice Department, NASA, the Federal Reserve, and the Senate. The U.S. Justice Department revealed that it had taken control of domains used by two hacking platforms named “QScan” and “QTRouter” that were part of the attack campaign.
According to an affidavit, the hacking victims included the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four undisclosed companies in the U.S. and South Korea. The Chinese Embassy in Washington did not respond to requests for comments, as Beijing typically denies involvement in cyber-attacks.
The Justice Department stated that the hacking platforms were operated by a Chinese company called Nanjing Xinjiuwei Network Technology Company, whose clients allegedly include China’s intelligence and military entities. Nanjing Xinjiuwei has not provided any immediate comments on the matter.
The affidavit mentioned that the group had been targeting critical infrastructure and sensitive networks in the U.S. and globally since 2018. The hackers attempted to breach NASA networks in 2019 and conducted intrusions at Energy Department laboratories, the NIH, an HHS agency, and a U.S. security device manufacturer in 2024.
Various government agencies and organizations identified as targets by the Justice Department did not respond immediately to requests for comments. Chinese-affiliated hacking operations have infiltrated several U.S. government and private networks in recent years.
Experts tracking Chinese cyber-activity suggest that private contractors often conduct significant cyber intrusions on behalf of Chinese government entities. Dakota Cary, a China analyst at cybersecurity firm SentinelOne, noted the proliferation of companies offering specialized offensive services in the past decade.