The Justice Department announced Wednesday that it had dismantled a Chinese state-sponsored hacking operation that breached its own networks and those of other sensitive U.S. agencies, marking a significant escalation in Washington's efforts to counter cyber threats from Beijing.
In a statement, the DOJ said it seized two hacking platforms, "QScan" and "QTRouter," operated by a group employed by Nanjing Xinjiuwei Network Technology Company, a Chinese-based firm. The platforms were used in tandem to "target U.S. critical infrastructure and other sensitive networks" on behalf of clients including China's Ministry of State Security and the People's Liberation Army, according to the department.
An affidavit unsealed in the Southern District of California detailed that the operation targeted the DOJ, NASA, the Federal Reserve, the Department of Energy, the U.S. Senate, the Department of Health and Human Services, and the National Institutes of Health. Other victims included government contractors, hospital networks, telecommunications providers, power companies, and financial institutions.
Attorney General Todd Blanche vowed to hold state-sponsored hackers accountable. "State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted," Blanche said. "We are here to ensure security for the American people and will use every tool we have to keep that promise."
The affidavit indicated that the Chinese firm's infrastructure had been used to compromise sensitive networks in the U.S. and globally since 2018. The Chinese Embassy in Washington did not immediately respond to a request for comment, though Beijing routinely denies allegations of hacking U.S. networks.
This action follows a separate 2024 Treasury Department initiative that charged ten Chinese hackers-for-hire and two officials in a scheme to steal data from American entities. FBI Director Kash Patel praised the joint operation, calling it "the latest technical operation against PRC-sponsored hacking" and a step forward in supporting President Trump's Cyber Strategy for America.
The announcement comes ahead of Chinese leader Xi Jinping's scheduled visit to the U.S. next month, where he will meet with President Trump. Asked whether the hacking scheme would be a topic of discussion, Blanche declined to prescribe the president's agenda, but emphasized the longstanding nature of the issue. "This is something that we've talked about with our counterparts in China for many, many years," Blanche told Fox News. "And we know that it's happening. And they know we know that it's happening. And it has to stop."
The seizure underscores the persistent cyber threat from state-sponsored actors, a concern that extends beyond federal agencies to critical infrastructure, as highlighted by recent breaches in water systems. The DOJ's move signals a more aggressive posture in disrupting these operations before they cause further damage.
