The FBI and Department of Justice announced in August 2026 the takedown of two tools used by a Chinese state-sponsored hacking group to breach a wide range of US government agencies and critical infrastructure, in a campaign stretching back to at least 2018.
The DOJ identified the group as QTFY, allegedly operating through a Nanjing, China-based contractor called Nanjing Xinjiuwei Network Technology Company. The company provided customers — said to include China’s Ministry of State Security and the People’s Liberation Army — with access to two tools: QScan, which scanned for vulnerabilities in internet-of-things devices to build botnets, and QTRouter, which managed customer access to those botnets and to rented commercial proxy servers used to relay and disguise hacking traffic.
Among the confirmed US government victims listed by the DOJ: NASA, the US Senate, the Federal Reserve, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and the Justice Department itself. The FBI’s affidavit also lists power companies, telecommunications providers, hospitals, financial institutions, and defense contractors as targeted sectors, though it does not confirm which were successfully breached or to what degree.
Over the past year, according to Lumen Technology’s Black Lotus Labs — which worked with the FBI and DOJ on the operation — the group shifted to hijacking VPN services used by Chinese citizens to bypass China’s Great Firewall, mixing malicious traffic with ordinary user traffic to evade detection. “It made it difficult for us to see the bad, state-sponsored traffic because there was so much typical user VPN traffic,” said Damon Rouse, a threat intelligence researcher at Black Lotus Labs.
The FBI disrupted the network by seizing domains hardcoded into the two tools. Lumen also “null-routed” certain domains, rendering them inoperable. No individual charges were announced alongside the operation.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Attorney General Todd Blanche said in a statement. Nanjing Xinjiuwei Network Technology Company could not be reached for comment.
Source: WIRED