<p class="wp-block-paragraph">The Justice Department on Wednesday announced the shutdown of several platforms associated with China that were involved in hacking the Senate and multiple government agencies.</p>
<p class="wp-block-paragraph">Officials stated that a Chinese company linked to the Beijing government hacked into various federal agencies, including the Federal Reserve, National Institutes of Health, National Aeronautics and Space Administration, and the Departments of Justice, Energy, and Health and Human Services. The DOJ and FBI seized two domains, QScan and QTRouter, after investigators identified QTFY, or the Nanjing Xinjiuwei Network Technology Company, as the entity using these systems to hack into the Senate, U.S. government agencies, and sensitive networks nationwide, according to officials.</p>
<p class="wp-block-paragraph">“Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China,” Attorney General Todd Blanche stated.</p>
<p class="wp-block-paragraph">“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” he added. “We are here to ensure security for the American people and will use every tool we have to keep that promise.”</p>
<p class="wp-block-paragraph">The cyberattacks have reportedly been ongoing since 2018, according to a court affidavit unsealed in the Southern District of California. Hackers also targeted networks operated by hospitals, telecommunications providers, power companies, financial institutions, and defense contractors, according to the filing.</p>
<p class="wp-block-paragraph">It remains unclear how successful the hacking attempts were. U.S. Senate systems were breached this year, an attempted hack of NASA servers occurred in August 2019, and an attack on an unidentified Ohio-based medical center took place in mid-2020, the affidavit noted. In 2024, the hackers targeted three Energy Department National laboratories, the National Institutes of Health, and a U.S. security device manufacturer, according to the affidavit.</p>
<p class="wp-block-paragraph">During a Fox News interview on Wednesday, Blanche was asked whether the cyberattacks would be discussed during Chinese President Xi Jinping’s visit to the U.S. next month, when he will meet with President Donald Trump.</p>
<p class="wp-block-paragraph">Blanche did not directly answer the question, stating he would not “tell President Trump what he needs to talk to the leadership about in China,” but emphasized that Chinese hacking “has to stop.”</p>
<p class="wp-block-paragraph">“This is something that we’ve talked about with our counterparts in China for many, many years,” the attorney general said. “And we know that it’s happening. And they know we know that it’s happening. And it has to stop.”</p>
<p class="wp-block-paragraph">The DOJ indicated that China’s Ministry of State Security and its military are among QTFY’s customers. QScan searches and automatically infects thousands of devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices, officials stated.</p>
<p class="wp-block-paragraph">QTRouter operates in conjunction with QScan, serving as an “obfuscation network” that allows QTFY and other malicious cyber actors to conceal the Chinese origin of their computer intrusion activities “because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks,” according to the DOJ.</p>
<p class="wp-block-paragraph">“Through complex investigations, aggressive technical operations, and strong partnerships, FBI San Diego will continue to identify, disrupt, and impose costs on our cyber adversaries,” Special Agent in Charge Mark Remily of the FBI San Diego Field Office stated. “We are committed to dismantling the tools behind these state-sponsored crimes and protecting the American people from malicious cyber activity.”</p>