U.S. authorities seize hacker platforms tied to China-backed attacks on critical infrastructure

Traders Union
All News
Financial News
US seizes China hacker platforms

Highlights

U.S. authorities seized the domains of QScan and QTRouter, crippled China-backed QTFY’s malware operations targeting critical infrastructure and sensitive networks including NASA and the Senate.
QTFY, tied to Nanjing Xinjiuwei Network Technology Company, sold hacking services to the Ministry of State Security and the People’s Liberation Army, using QScan for global IoT infections and QTRouter to mask attack origins.
The FBI’s broader campaign includes removing PlugX malware from over 4,000 U.S. computers in 2025, dismantling botnets in 2023 and 2024, and disseminating threat intelligence on QTFY since 2018.

Court action targets QScan and QTRouter

As reported by the U.S. Department of Justice, the Justice Department and FBI have announced court-authorized seizures of domains tied to the hacking platforms known as QScan and QTRouter. Officials say the domains are essential to the malware’s communication and authentication functions, making both platforms inoperable after the seizure.

Court documents unsealed in the Southern District of California describe QTFY as a People’s Republic of China state-sponsored group employed by Nanjing Xinjiuwei Network Technology Company. Prosecutors say the group created and operated the two platforms to support intrusions into U.S. critical infrastructure and other sensitive networks, with victims including NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate.

According to the court filings, QTFY sells hacking services to paying customers that include China’s Ministry of State Security and the People’s Liberation Army. The documents say QScan scans for and automatically infects internet-of-things devices worldwide, while QTRouter uses compromised devices, commercial proxy services and leased virtual private servers to mask the origin of malicious traffic and make attacks appear to come from systems outside the People’s Republic of China.

Broader cyber defense push against PRC-linked activity

The seizure forms part of a wider series of technical operations against what U.S. officials describe as indiscriminate hacking activity linked to the People’s Republic of China. The Justice Department says the FBI removed PlugX malware from more than 4,000 U.S. computers in 2025, disabled a botnet of hundreds of thousands of infected internet-of-things devices in 2024 that it linked to Flax Typhoon, and disrupted a separate botnet in 2023 tied to Volt Typhoon.

Officials also say the FBI and National Security Agency are publishing a cybersecurity advisory with indicators of compromise related to QTFY, based on analysis of malicious activity dating back to at least 2018. Lumen Technologies’ threat intelligence unit, Black Lotus Labs, is also publishing details of the group’s tactics, techniques and procedures.

The investigation and disruption effort is led by the FBI’s San Diego Field Office and Cyber Division, the U.S. Attorney’s Office for the Southern District of California, and the National Security Cyber Section of the Justice Department’s National Security Division. Senior U.S. officials say the operation is intended to cut off infrastructure used to obscure hostile cyber activity and strengthen defenses around essential services.

In our earlier article on fiscal dominance and U.S. Treasury market strains, we looked at how rising public debt and higher long-dated yields are reviving concerns that central banks could face pressure to indirectly ease governments’ financing burdens. We also outlined measures policymakers have discussed to reduce stress in the bond market—such as Treasury buybacks and potential adjustments to liquidity backstops—while noting that investors remain wary of persistent deficits and credibility risks.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.