US disables QScan and QTRouter after China-linked hackers target NASA and Fed

The US Justice Department and FBI have disrupted two cyber platforms allegedly used by Chinese state-sponsored hackers to penetrate or target some of America’s most sensitive government and critical-infrastructure networks, including NASA, the Federal Reserve, Department of Energy and US Senate.

Court-authorised seizures targeted domains essential to QScan and QTRouter, complementary systems that the Justice Department says were operated by a group known as QTFY through China-based Nanjing Xinjiuwei Network Technology Company. US authorities allege the company supplied hacking services to customers including China’s Ministry of State Security and People’s Liberation Army.

China disputes the broader US attribution. Its embassy said Beijing opposes cyberattacks and accused Washington of using cybersecurity issues to discredit China and justify discriminatory restrictions against Chinese companies.

How did QScan and QTRouter turn ordinary internet-connected devices into hacking infrastructure?

The two platforms performed different functions that became much more powerful when combined. According to court documents, QScan searched for vulnerable internet-of-things devices around the world and automatically compromised large numbers of them, creating a continuously refreshed pool of computers and network equipment that malicious operators could exploit.

QTRouter then combined those compromised devices with commercial proxy services and leased virtual private servers to build an obfuscation network. Instead of a hacking attempt appearing to originate from infrastructure inside China, malicious traffic could emerge from an infected router, camera or other device located in another country or potentially near the intended target.

That geographic disguise complicates network defence because blocking all traffic from China cannot stop an operation that appears to come from an ordinary domestic internet connection. Investigators also have to determine whether the apparent source of an attack belongs to the attacker or to an unsuspecting consumer whose equipment has itself been compromised.

The technique demonstrates why the security of cheap connected devices has become a national-security issue. A poorly protected router sold to a home or small business may appear inconsequential in isolation, yet thousands of similarly vulnerable products can collectively become infrastructure for sophisticated state-linked cyber operations.

Which US institutions were allegedly targeted by the QTFY hacking operation?

The Justice Department identified a particularly sensitive group of victims and attempted victims, including NASA, the Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health and US Senate. Court documents also describe activity affecting companies and organisations in sectors such as healthcare, telecommunications, energy, finance, defence manufacturing and higher education.

The incidents stretched back to at least 2018, indicating that investigators were confronting a long-running cyber-espionage infrastructure rather than responding to one newly discovered intrusion. Reuters reported unsuccessful attempts against NASA in 2019 and later activity involving federal laboratories, healthcare agencies and private companies.

The fact that a target appears on the list does not mean the hackers obtained every type of information available inside that organisation. Cyber incidents range from unsuccessful intrusion attempts through limited network access to deeper compromise, and the precise damage differed among targets.

The breadth is nevertheless strategically important because the alleged campaign crossed traditional boundaries between government espionage and critical infrastructure. A platform capable of reaching federal agencies, hospitals, utilities and defence contractors can support intelligence collection while also creating access that might become useful during a geopolitical crisis.

Why did seizing only a handful of internet domains disable the platforms?

The Justice Department says the seized domains were hard-coded into QScan and QTRouter and were needed for functions including communication and authentication. Taking control of those domains therefore interrupted essential connections between operators and the malicious infrastructure, making the platforms inoperable under their existing configuration.

This type of operation differs from arresting every person associated with a cyber group. US law-enforcement agencies increasingly use technical interventions to seize servers, domains or command infrastructure even when the alleged operators remain beyond American jurisdiction.

The advantage is immediate disruption. Investigators do not need to persuade another country to extradite a suspect before preventing a botnet from continuing to function through infrastructure subject to US legal authority.

The limitation is that experienced hackers can build replacement systems. The QTFY operators may lose infrastructure, access and time without necessarily losing their underlying expertise or relationships, making the long-term value of the operation dependent partly on how difficult and expensive the United States can make reconstruction.

How does the QScan operation fit into the wider US-China cyber confrontation?

The takedown follows several US operations targeting infrastructure attributed to Chinese hacking groups. The FBI removed PlugX malware from more than 4,000 US computers in 2025, disrupted a large Flax Typhoon botnet in 2024 and acted against infrastructure associated with Volt Typhoon in 2023.

Washington has increasingly argued that Chinese cyber operations involve not only intelligence agencies directly but also a broader ecosystem of private contractors capable of supplying tools, infrastructure or access. The QTFY allegations fit that model because Nanjing Xinjiuwei is described as a commercial company whose services were allegedly used by government customers.

Beijing consistently rejects American allegations of state-directed cyberattacks and argues that China is itself a major victim of hacking. That competing narrative makes independent verification difficult because much of the evidence underlying attribution remains classified or appears in court and intelligence documents prepared by one side.

The policy consequence is clearer than the unresolved diplomatic argument. US cybersecurity agencies increasingly assume that state-linked operators will attempt to hide behind ordinary commercial infrastructure and compromised consumer devices, making defence dependent on disrupting entire technical ecosystems rather than simply identifying individual hackers.

What should American organisations do after QScan and QTRouter were disabled?

The FBI and National Security Agency released technical indicators to help network defenders identify evidence associated with QTFY activity. Organisations that discover those indicators need to determine whether the presence reflects attempted scanning, a compromised edge device or deeper access into internal networks.

Consumer and enterprise IoT security also deserves attention because compromised devices can remain vulnerable even after one command network disappears. Updating firmware, removing unsupported equipment, changing default credentials and restricting unnecessary internet exposure can reduce the pool of devices available for replacement botnets.

Large organisations face a more complicated task because sophisticated attackers frequently exploit legitimate tools after initial access, making malware signatures only one part of detection. Network behaviour, authentication anomalies and unexpected traffic patterns can become equally valuable indicators.

The Justice Department has succeeded in shutting down the particular QScan and QTRouter infrastructure described in its court action. The strategic problem remains broader: cyber-espionage groups have learned that the enormous global population of insecure connected devices can provide a renewable layer of camouflage, meaning dismantling one network does not eliminate the model that made it effective.