US seizes Chinese-linked hacking domains

What's happened

The Justice Department has seized web domains linked to two hacking platforms, QScan and QTRouter, that prosecutors say a China-linked group called QTFY used since at least 2018 to probe and, in some cases, breach US agencies and private firms including DOE labs, NIH, NASA and the Federal Reserve.

What's behind the headline?

What the takedown actually did

• The domain seizures have disrupted two platforms — QScan, which scanned and infected internet-connected devices, and QTRouter, which routed malicious traffic through those devices. Removing hardcoded domains will make the specific botnet infrastructure inoperable and slow the operators.

Why this matters

• The platforms were acting as obfuscation layers. They let attackers make traffic appear to come from third-party routers and devices, which will have been masking attribution and delaying defensive responses. With those layers removed, defenders will identify attacker activity more quickly and attribute intrusions with greater confidence.

Limits of the action

• Court-ordered domain seizures do not eliminate the underlying tools or the actors. The affidavit shows many attempts failed and some succeeded; the operators will adapt by rebuilding command-and-control channels or shifting to new providers. The disruption reduces their daily capability but does not end the campaign.

Likely next steps

• Federal agencies will increase network scanning and incident response to hunt for lingering access. Congress will press agencies for briefings because major-incident reporting rules require disclosure of significant breaches. Private-sector victims will harden exposed systems and share indicators of compromise.

Strategic consequences

• This operation will raise the cost and complexity for the accused group and its alleged contractors. It will also sharpen US legal and technical tools for dismantling overseas infrastructure. Expect Beijing to deny state involvement and to push back diplomatically while cybersecurity firms and US agencies accelerate attribution and mitigation work.

How we got here

US investigators have traced a botnet and command-and-control infrastructure to a Nanjing company, Nanjing Xinjiuwei, which the affidavit says sold access to Chinese intelligence and military customers. The FBI, NSA and US Cyber Command have issued joint advisories detailing intrusions and unsuccessful attempts stretching from 2018 through 2026.

Our analysis

The publications agree on the core facts but emphasise different details and tones. The Justice Department filings, quoted across outlets, present the legal case: an affidavit describes QScan and QTRouter and identifies affected entities including DOE laboratories, NIH, HHS and the Federal Reserve. Al Jazeera highlighted the Justice Department's correction clarifying that agencies were targeted but not all were breached, noting the revised statement removed an earlier claim that all named agencies had been victims. TechCrunch and TechCrunch's security editor focused on technical specifics and operational impact, saying the domains were hardcoded into the botnet and that seizing them rendered the command-and-control servers "inoperable." The Times of Israel and the Independent stressed the allegation that a Nanjing firm, Nanjing Xinjiuwei, supplied services to Chinese intelligence and military clients; both outlets cite the affidavit directly for that claim. Bloomberg and the New York Post reported a broader list of affected agencies, with the New York Post relaying statements by DOJ officials stressing prosecution and national security angles. Across the coverage, direct legal language appears in the affidavit; for instance, the FBI described the group as having "targeted" federal networks since at least 2018. Al Jazeera is the clearest in noting the DOJ's subsequent correction about who was actually compromised, which narrows confirmed breaches and matters for assessing damage and policy responses.

Go deeper

• Which US agencies have confirmed they were actually breached versus merely targeted?
• What indicators of compromise should companies and hospitals look for now?

More on these topics

• National Aeronautics and Space Administration - Agency

  The National Aeronautics and Space Administration is an independent agency of the U.S. Federal Government responsible for the civilian space program, as well as aeronautics and space research.

• United States Department of Energy - Government department

  The United States Department of Energy is a cabinet-level department of the United States Government concerned with the United States' policies regarding energy and safety in handling nuclear material.

• People's Republic of China - Country in East Asia

  China, officially the People's Republic of China, is a country in East Asia. It is the world's most populous country, with a population of around 1.4 billion in 2019.

• United States National Institutes of Health - US government medical research agency

  The National Institutes of Health (NIH) is the primary agency of the United States federal government responsible for biomedical and public health research. It was founded in 1887 and is part of the United States Department of Health and Human Services (HHS). Many NIH facilities are located in Bethesda, Maryland, and other nearby suburbs of the Washington metropolitan area, with other primary facilities in Research Triangle Park in North Carolina and smaller satellite facilities located around the United States. The NIH conducts its scientific research through the NIH Intramural Research Program (IRP) and provides significant biomedical research funding to non-NIH research facilities through its Extramural Research Program. As of 2013, the IRP had 1,200 principal investigators and more than 4,000 postdoctoral fellows in basic, translational, and clinical research, being the largest biomedical research institution in the world, while, as of 2003, the extramural arm provided 28% of biomedical research funding spent annually in the U.S., or about US$26.4 billion. Basic research by the NIH contributed to every new drug approved by the Federal Drug Administration over the period 2010–2016...

• United States - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.

• United States Department of Health and Human Services - Government department

  The United States Department of Health & Human Services, also known as the Health Department, is a cabinet-level executive branch department of the U.S. federal government with the goal of protecting the health of all Americans and providing essential

• Federal Bureau of Investigation - Law enforcement agency

  The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency.

• Senate - Type of legislative body, often the upper house or chamber of a bicameral legislature

  A senate is a deliberative assembly, often the upper house or chamber of a bicameral legislature. The name comes from the ancient Roman Senate (Latin: Senatus), so-called as an assembly of the senior (Latin: senex meaning "the elder" or "old man") and...

• Kash Patel - Director of the Federal Bureau of Investigation

  Kashyap Pramod Patel (born February 25, 1980) is an American lawyer serving since 2025 as the director of the Federal Bureau of Investigation. Patel also served as acting director of the Bureau of Alcohol, Tobacco, Firearms and Explosives from February...

• South Korea - Country in East Asia

  South Korea, officially the Republic of Korea, is a country in East Asia, constituting the southern part of the Korean Peninsula and sharing a land border with North Korea.

• Michigan - US State

  Michigan is a state in the Great Lakes and Midwestern regions of the United States. Its name comes from the Ojibwe word mishigami, meaning "large water" or "large lake".

• SentinelOne - Cybersecurity company

  SentinelOne is a startup cybersecurity based in Mountain View, California. The company was founded in 2013 by Tomer Weingarten, Almog Cohen and Ehud Shamir. Weingarten acts as the company's CEO. Nicholas Warner is the company's COO.