Chinese hackers breached DOJ, NASA, Federal Reserve, and Senate in major cyber operation

The U.S. Justice Department announced on August 26, 2026, that it disrupted a major Chinese state-sponsored cyber-espionage operation active since 2018. The hacking group QTFY, employed by Nanjing Xinjiuwei Network Technology Company, breached sensitive federal agencies including the DOJ, NASA, the Federal Reserve, and the Senate, alongside critical infrastructure. U.S. authorities disabled the operation by seizing domains for the QScan and QTRouter malware platforms.

Chinese hacking operation disruption

• ▪FBI Director Kash Patel stated on August 26, 2026, that the bureau helped disrupt a global botnet and hacking platform used by Chinese state-sponsored hackers
• ▪U.S. Attorney General Todd Blanche stated on August 26, 2026, that federal law enforcement investigated and disabled malicious software sponsored by the People's Republic of China
• ▪The U.S. Justice Department announced on August 26, 2026, the disruption of a Chinese state-sponsored hacking operation targeting sensitive U.S. federal agencies and critical infrastructure

QScan platform seizure

• ▪The QScan hacking platform scanned and automatically infected thousands of internet-of-things devices worldwide to add them to a controlled network, according to court documents
• ▪U.S. authorities seized internet domains used by the QScan hacking platform, rendering the platform inoperable on August 26, 2026

QTRouter platform seizure

• ▪The U.S. Justice Department stated that the seized internet domains were hard-coded into both the QScan and QTRouter malware
• ▪The QTRouter hacking platform served as an obfuscation network to conceal the Chinese government-linked origin of computer intrusion activities, according to court documents
• ▪U.S. authorities seized internet domains used by the QScan hacking platform, rendering the platform inoperable on August 26, 2026

Federal agency breach victims

• ▪The Chinese cyber-espionage campaign targeted non-governmental networks operated by hospitals, telecommunications providers, power companies, financial institutions, and defense contractors
• ▪The Chinese hacking operation breached multiple sensitive U.S. government agencies, including the Department of Justice, the Federal Reserve, the U.S. Senate, and NASA
• ▪The Chinese hacking operation breached the U.S. Department of Energy, the Department of Health and Human Services, and the National Institutes of Health
• ▪An affidavit unsealed in August 2026 revealed that the Chinese hacking campaign against U.S. networks has been active since at least 2018

QTFY hacking group

• ▪A People's Republic of China state-sponsored group known as QTFY created and operated the QScan and QTRouter hacking platforms, according to court documents
• ▪The QTFY hacking group offers computer hacking services to paying customers, including China's Ministry of State Security and the People's Liberation Army

Nanjing Xinjiuwei Network Technology

• ▪The QTFY hacking group was employed by the China-based Nanjing Xinjiuwei Network Technology Company, according to court documents unsealed in August 2026
• ▪Nanjing Xinjiuwei Network Technology Company provides services to clients including China's military, civilian intelligence agency, and Ministry of State Security, according to the U.S. Justice Department

3 sources