The United States announced on Wednesday that it had disrupted a Chinese cyber attack operation targeting the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and various other sensitive government entities. The U.S. Justice Department disclosed that it had taken control of domains utilized by two hacking platforms known as “QScan” and “QTRouter,” which were part of the hacking campaign.
An affidavit revealed that the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and four undisclosed companies in the United States and South Korea were among the victims of the hackers. The Chinese Embassy in Washington did not respond immediately to requests for comment, consistent with Beijing’s usual denial of involvement in hacking activities.
The Justice Department stated that the hacking platforms were operated by a China-based company, Nanjing Xinjiuwei Network Technology Company, with clients including China’s Ministry of State Security and the People’s Liberation Army. Nanjing Xinjiuwei did not provide an immediate comment upon request.
According to the affidavit, the hacking group’s infrastructure had been used to breach critical infrastructure and sensitive networks in the U.S. and globally since 2018. The hackers attempted to access NASA networks in August 2019 through a virtual private network vulnerability and conducted intrusions at Energy Department facilities, the NIH, an HHS agency, and a U.S. security device manufacturer in September 2024.
Government representatives mentioned in the Justice Department’s report did not respond promptly to comment requests. Recent years have seen Chinese-linked hacking operations compromising multiple U.S. government and private networks. The FBI informed Congress in March about hackers infiltrating certain agency networks tied to FBI investigations, later attributed to China.
Chinese hackers have also been linked to breaches in U.S. House of Representatives committee networks and major telecommunications companies. Analysts observing Chinese cyber activities note that private contractors often conduct high-profile intrusions on behalf of Chinese government agencies, reflecting the proliferation of offensive service providers in recent years.
