U.S. Disrupts China-Linked Hacking Campaign Targeting Government Agencies

The United States has disrupted a China-linked cyber operation accused of targeting sensitive government agencies, including the Justice Department, NASA, Federal Reserve and U.S. Senate, authorities said Wednesday.

The U.S. Justice Department announced the seizure of domains associated with two hacking platforms known as QScan and QTRouter. Officials said the tools were used in a long-running cyber campaign against government networks, critical infrastructure and private organizations.

According to a court affidavit, targets included the Department of Energy, Department of Health and Human Services, National Institutes of Health and four unidentified companies in the United States and South Korea.

The Justice Department linked the hacking platforms to China-based Nanjing Xinjiuwei Network Technology Company. U.S. authorities said its clients included China's Ministry of State Security and the People's Liberation Army. The company did not immediately comment.

China's embassy in Washington said it was unfamiliar with the specific allegations but stressed that Beijing opposes and combats cyberattacks. The embassy also accused Washington of using cybersecurity concerns to discredit China and impose restrictions on Chinese companies.

U.S. investigators said the hacking activity dates back to at least 2018. An attempted breach of NASA networks in August 2019 targeted a virtual private network vulnerability but was unsuccessful.

In September 2024, hackers allegedly penetrated three Energy Department laboratories, the NIH, an HHS agency and a U.S. security-device manufacturer. A joint advisory from the FBI, NSA and U.S. Cyber Command also detailed successful data theft from defense contractors, financial institutions and universities in May 2024.

The hackers later scanned for vulnerabilities and unsuccessfully targeted U.S. Senate networks and an American hospital in March 2026.

The operation adds to growing U.S. concerns over Chinese-linked cyberattacks against government institutions, telecommunications companies and other critical networks. Cybersecurity experts say private Chinese contractors have increasingly provided specialized offensive hacking capabilities to government agencies, expanding the scale and sophistication of state-linked cyber operations.