The U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have announced the disruption of hacking tools identified as "QScan" and "QTRouter," which were allegedly used by Chinese state-sponsored actors to breach multiple U.S. federal agencies and critical infrastructure since 2018. The tools are reportedly operated by Nanjing Xinjiuwei Network Technology Company, a China-based entity, primarily for the benefit of China's Ministry of State Security and the People's Liberation Army.
Among the confirmed targets of these tools were the Federal Reserve, the Department of Energy, the Department of Justice itself, the U.S. Senate, and NASA. Other alleged victims include the Department of Health and Human Services, the National Institutes of Health, various hospitals, telecommunications providers, power companies, financial institutions, and defense contractors.
QScan is described as a scanning platform designed to identify and automatically infect internet-of-things (IoT) devices globally, including home routers and security cameras. These compromised devices were then integrated into a botnet. QTRouter functioned as an obfuscation network, enabling attackers to mask the true origin of their operations by routing traffic through the infected devices. This capability allowed the attacks to appear as if they originated from other countries or even from local sources.
The state-sponsored group utilizing these tools is known as "QTFY." According to FBI Assistant Director Brett Leatherman, QTFY has exploited devices in over 130 countries and operates within a complex network that includes "hackers-for-hire" and government clients in China. Nanjing Xinjiuwei is accused of selling stolen data and hacking services directly to Chinese military and intelligence agencies.
Investigations into QTFY's infrastructure have been ongoing since 2018, continuing up to an attack on the U.S. Senate that occurred this year. While the affidavit confirms the Senate was targeted, it does not specify whether particular senators or committees were affected.
The FBI and DOJ have confirmed that the takedown has rendered both QScan and QTRouter inoperable. This was achieved because essential functions of the platforms, such as communication and authentication, relied on hard-coded domains that have now been seized. The FBI also noted that QTFY had customers beyond the Chinese government, though these were not specified.
One of the earliest incidents investigated by the FBI involving these tools was a 2019 attack on NASA. In this instance, hackers attempted to exploit a vulnerability in Pulse Secure VPN. Investigators traced the IP addresses used in the NASA attack to locations and email addresses within China.
This operation marks another instance of U.S. law enforcement targeting platforms used by state-backed hackers to obscure their cyberattacks. In previous efforts, U.S. government agents have obtained court orders to access devices and remove malware installed by Chinese and Russian hackers. Notable past disruptions include the removal of PlugX surveillance malware from thousands of U.S. computers last year and the disruption of botnets operated by Chinese government hacking groups Volt Typhoon and Flax Typhoon in 2024.
