US says Chinese-linked hackers attacked NASA, Senate, and gov’t agencies

Al Jazeera  |  Catherine Nouhan

United States law enforcement authorities disrupted a China-affiliated cyber operation that targeted sensitive government institutions, including the Department of Justice, NASA, the Federal Reserve, and the US Senate. The operation dismantled two hacking platforms, QScan and QTRouter, which had infected thousands of internet-connected devices worldwide to disguise the origin of cyberattacks since at least 2018.

Federal prosecutors attributed the infrastructure to Nanjing Xinjiuwei Network Technology Company, a firm linked to China's Ministry of State Security and the People's Liberation Army. Hackers unsuccessfully attempted to breach NASA in August 2019 before successfully penetrating three Department of Energy laboratories, the National Institutes of Health, and the Department of Health and Human Services in September 2024. Routing traffic through compromised external devices obscured overseas origin points, delaying detection and attribution. Domain seizures disrupted operational capability. The action forms part of broader court-authorized measures led by federal law enforcement agencies against state-sponsored covert digital intrusions.

Comment

The deployment of QTRouter botnet infrastructure by Nanjing Xinjiuwei Network Technology Company demonstrates a shift toward proxy-based operational relay networks in Chinese cyber espionage operations. Interposing compromised commercial edge devices between Ministry of State Security operators and foreign targets degrades network-boundary telemetry and complicates forensic attribution. This architecture exploits domestic IP space near targeted U.S. federal networks to bypass perimeter access controls reliant on geographical IP filtering.

Consequently, defensive teams at institutions like the Department of Energy face diminished early-warning indicators when malicious traffic mirrors internal network nodes. The judicial domain seizure of QScan infrastructure forces Ministry of State Security operators to rebuild relay chains, creating temporary windows of operational visibility for FBI cyber analysts.

Strategic Question for Discussion

Which strategy offers greater long-term friction against Ministry of State Security operators using QTRouter infrastructure — judicial domain seizures by the FBI, or mandatory zero-trust microsegmentation across U.S. federal networks?

The recurring re-establishment of proxy infrastructure suggests that judicial domain seizures provide only temporary operational friction against entities like Nanjing Xinjiuwei Network Technology Company. Consequently, systemic resilience against Ministry of State Security intrusions depends more directly on internal network microsegmentation that neutralises compromised perimeter nodes regardless of their apparent origin.

Share your assessment in the comments below.