The United States announced on Wednesday that it had disrupted a Chinese cyber intrusion operation targeting the U.S. Justice Department, NASA, the Federal Reserve, the Senate, and other sensitive government entities. According to the U.S. Justice Department, it successfully seized control of domains associated with two hacking platforms known as “QScan” and “QTRouter,” which were utilized in the cyber campaign. An affidavit revealed that the U.S. Department of Energy, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), as well as four unnamed U.S. and South Korean companies, were among the victims of the hackers.
While the Chinese Embassy in Washington did not respond to immediate requests for comment, the Justice Department disclosed that the hacking platforms were operated by a China-based company called Nanjing Xinjiuwei Network Technology Company. The firm’s clients allegedly included China’s Ministry of State Security and the People’s Liberation Army. Nanjing Xinjiuwei Network Technology Company did not provide an immediate response to comment requests.
The affidavit further indicated that the group’s computer infrastructure had been used to compromise critical infrastructure and sensitive networks in the U.S. and globally since at least 2018. The hackers attempted to breach NASA networks in August 2019 through a virtual private network vulnerability and conducted intrusions at Energy Department laboratories, the NIH, an undisclosed HHS agency, and a U.S. security device manufacturer in September 2024.
Representatives of the targeted agencies and government organizations identified by the Justice Department did not respond immediately to comment requests. Chinese-affiliated hacking activities have previously infiltrated various sensitive U.S. government and private networks. In a separate incident, the FBI informed Congress in March about hackers infiltrating agency networks linked to individuals under FBI scrutiny, with subsequent reports linking the breach to China. Chinese-associated hackers have also been implicated in compromising U.S. House of Representatives committee networks and several major telecommunications companies in recent years.
According to experts monitoring Chinese cyber operations, private contractors often conduct high-profile intrusions on behalf of different Chinese government agencies. SentinelOne cybersecurity company’s China analyst, Dakota Cary, noted a significant increase in companies providing specialized offensive cyber services over the past decade.