U.S. agents say they crippled a China-linked hacking service that hid attacks on key federal systems by routing them through everyday devices worldwide.
Story Snapshot
- Justice Department seized domains tied to QScan and QTRouter platforms used in intrusions, officials say.
- Court filings link the tools to a China state-backed group, QTFY, working through a Nanjing company.
- Targets included the Justice Department, NASA, the Federal Reserve, the Senate, and health agencies, reports say.
- Chinese officials deny the claims and call them political smears without proof.
What the government says it shut down
The Justice Department said on August 26 it seized internet domains that powered two hacking platforms named QScan and QTRouter. Officials said these platforms were used to attack U.S. critical systems and sensitive networks. They described the move as a court-approved action to cut access and break the tools’ links. The government said both platforms were part of a service that let attackers hide their tracks while hitting many targets at once.
Prosecutors said QScan scanned the internet and infected thousands of connected devices, like cameras and routers, around the world. They said those devices then fed traffic into QTRouter, which worked like a cloak. Intrusion attempts would then appear to come from regular computers outside China. The filings said the domains seized were hard-coded into the malware. That design choice meant removing those domains would stop the platforms from working.
Who is blamed and who was hit
The unsealed court documents said a group called QTFY built and ran the platforms, and that it worked through Nanjing Xinjiuwei Network Technology Company in China. Officials described it as a state-backed effort. Media reports that reviewed the affidavit said victims included the Justice Department, the National Aeronautics and Space Administration, the Federal Reserve, the United States Senate, and health agencies such as the Department of Health and Human Services and the National Institutes of Health.
Reporters also said the government linked Nanjing Xinjiuwei’s clients to China’s Ministry of State Security and the People’s Liberation Army. The filings and press statements cast QScan and QTRouter as a hacking service, not just a one-off piece of malware. They described a campaign running back to at least 2018, with repeated use against government and private networks in the United States and abroad.
What is confirmed, and what remains unclear
Officials provided platform names, a basic playbook, and a remedy: domain seizures to cut command links. They also listed agencies and sectors that were targeted or affected. But the public record does not include the full affidavit, forensic logs, or malware samples. That limits outside review of exactly how the tools worked, how targets were chosen, and which intrusions were successful versus attempted. Several victims have not issued their own incident reports in public so far.
The Fed Was Hit, But That Is Not the Real Story
The US Says China Built Hacking Infrastructure as a Service————–
The viral version is simple:
“Chinese hackers broke into the Federal Reserve.”That is directionally based on a real US government action, but it… https://t.co/PNxFQSzc8T pic.twitter.com/G4L08uEtEl
— PetrAnto (@petranto) August 27, 2026
Those gaps are common in cyber cases, where agents hold back details to protect sources and methods. Experts say governments should share enough evidence for crosschecking when they make major attributions. Clearer disclosures from agencies like the Senate, the National Aeronautics and Space Administration, or the Federal Reserve would help measure impact. Independent malware analysis would also let outside labs confirm that the seized domains truly disabled the core operation.
China’s response and the politics around attribution
China’s embassy rejected the hacking claims and said Beijing opposes all forms of cyberattacks. It called the U.S. statements unfounded and said Washington was using cybersecurity to smear China. These denials match past Chinese responses to similar cases. They push back on intent and evidence and frame the dispute as political. The embassy did not present independent technical data to rebut the U.S. filings in the reporting reviewed here.
Public fights over cyber attribution have grown more intense as both sides guard evidence. That tension fuels distrust at home. Americans across parties see elite failures when basic systems get hit while leaders trade blame. People want proof, not press lines. They also want assurance that the lights stay on, the banks are safe, and hospitals can run without fear. Clear facts, steady defenses, and transparent follow-up reports can rebuild trust when politics muddy the water.
Why this matters for your wallet and safety
When attackers hide inside home gadgets and small office gear, they raise costs for everyone. Companies must replace devices and tighten networks. Agencies must spend time and money on cleanup rather than service. If the Federal Reserve or health agencies face repeated attacks, markets can shake and care can suffer. Domain seizures may slow the threat for now. But long-term fixes need stronger device security, faster patching, and real penalties on those who sell hacking as a service.
Here is the bottom line. The government says it knocked out a powerful cloak that hid attacks on core U.S. systems. China denies it all. The facts we can see are detailed but not complete. The risk to daily life is real even when details are sealed. Keep pressure on leaders to show more evidence, close the gaps, and prove that basic services are safe. That is how we move from headlines to real security that serves the public, not the insiders.
Sources:
© conservativefreepress.com 2026. All rights reserved.
