US Disrupts Chinese Hacking Operation Targeting Agencies

US authorities say they have disrupted a Chinese-linked hacking operation accused of targeting sensitive American government networks, including those of the Justice Department and NASA.

The US Department of Justice said on Wednesday that it had seized domains connected to two hacking platforms, known as QScan and QTRouter, which investigators said were used in the cyber campaign.

An affidavit identified the US Department of Energy, Department of Health and Human Services and National Institutes of Health among the organisations targeted. Four unnamed companies in the US and South Korea were also listed as victims.

The Justice Department said the platforms were operated by Nanjing Xinjiuwei Network Technology Company, a China-based firm whose clients allegedly included China’s Ministry of State Security and the People’s Liberation Army.

The Chinese government rejected the allegation that it supports such activity. A spokesperson for the Chinese Embassy in Washington said Beijing “firmly opposes ‌and combats all forms of cyberattacks in accordance with the law.”

The spokesperson also accused the US of using cybersecurity concerns to “smear or discredit China” and said Beijing would protect the legitimate interests of Chinese companies.

According to the affidavit, the hacking campaign has operated since at least 2018, using tools designed to target critical infrastructure and other sensitive networks in the US and elsewhere.

Not every attempt succeeded. In August 2019, for example, hackers tried unsuccessfully to enter NASA networks by exploiting a vulnerability in a virtual private network.

The affidavit said that in September 2024, the attackers successfully breached three unnamed Energy Department laboratories, the NIH, an unnamed HHS agency and a US security-device manufacturer.

A joint advisory from the FBI, NSA and US Cyber Command’s Cyber National Mission Force also detailed hacking activity linked to the campaign. The operations included successful data theft from unnamed defence contractors, financial institutions and universities in May 2024.

The attackers later scanned for weaknesses in the networks of the US Senate and a US hospital in March 2026, although those attempts were unsuccessful.

NASA declined to comment on specific incidents, while HHS directed questions to the Justice Department.

The latest action comes amid growing concern over Chinese cyber activity targeting American government and private-sector networks. Chinese-linked hackers have been associated with several recent breaches involving US telecommunications companies, House of Representatives committee networks and other sensitive systems.

In March, the FBI also notified Congress that hackers had accessed certain agency networks connected to people under FBI investigation. Public reports later attributed that breach to China.

Cybersecurity experts say private companies often conduct sophisticated attacks on behalf of Chinese government agencies.

“Over the last decade, the number of companies offering niche offensive services has exploded,” said Dakota Cary, a China analyst with cybersecurity company SentinelOne.

The case highlights the continuing cybersecurity tensions between Washington and Beijing, as US authorities step up efforts to identify and disrupt hacking networks linked to Chinese interests.

What impact could the latest US action have on the growing cybersecurity tensions between Washington and Beijing?