The United States announced on Wednesday that it has disrupted a Chinese cyber hacking operation that targeted the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and other sensitive government entities. According to a statement from the U.S. Justice Department, they have taken control of domains associated with two hacking platforms known as “QScan” and “QTRouter” that were part of the illicit campaign.
An affidavit revealed that the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), as well as four unnamed American and South Korean companies, were among the victims of the hackers. The Chinese Embassy in Washington did not respond immediately to requests for comments, as Beijing commonly denies involvement in hacking activities.
The Justice Department disclosed that the hacking platforms were operated by a China-based company called Nanjing Xinjiuwei Network Technology Company, whose clientele includes China’s civilian intelligence agency, the Ministry of State Security, and the military, the People’s Liberation Army. Nanjing Xinjiuwei has not provided a comment yet in response to the allegations.
The affidavit outlined that the hackers’ infrastructure has been used to breach critical networks in the U.S. and globally since at least 2018. The hackers attempted to access NASA networks in August 2019 but were unsuccessful. In September 2024, intrusions were carried out at three Energy Department laboratories, the NIH, an undisclosed HHS agency, and a U.S. security device manufacturer.
Requests for comments from the targeted agencies and government organizations identified by the Justice Department were not immediately answered. Chinese-linked hacking activities have compromised several U.S. government and private networks in recent times. The FBI informed Congress in March about hackers infiltrating specific agency networks related to FBI investigations, with subsequent reports attributing the breach to China. Chinese-linked hackers have also been linked to compromises of U.S. House of Representatives committee networks and major telecommunications companies.
Cybersecurity experts monitoring Chinese cyber operations suggest that private contractors frequently conduct prominent intrusions on behalf of various Chinese government agencies. Dakota Cary, a China analyst at cybersecurity firm SentinelOne, noted the proliferation of companies providing specialized offensive services over the past decade.