The U.S. Department of Justice and FBI announced on August 26, 2026 the seizure of domains behind two hacking platforms, QScan and QTRouter, that court documents say a Chinese state-sponsored group used to compromise the Federal Reserve, the U.S. Senate, NASA, the DOJ itself, the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health. The Record reports the intrusions date back to 2018, and FBI Assistant Director Brett Leatherman said the group exploited devices in more than 130 countries. Critically, the DOJ has not detailed the damage to any victim, and as of publication there is no statement from the Federal Reserve itself in any of the available reporting. Everything below rests on unsealed court filings and press accounts of them, not on victim confirmation.
What Happened
Court documents unsealed in California federal court, per CNBC, attribute the creation and operation of QScan and QTRouter to a state-sponsored group tracked as "QTFY," which the filings say was employed by Nanjing Xinjiuwei Network Technology Company, a China-based firm. The Record, citing the DOJ affidavit, goes further than the other outlets on customer attribution: it reports the tools were used "primarily by China's Ministry of State Security and the People's Liberation Army." That MSS and PLA linkage appears in The Record's account of the affidavit and is not reflected in the CNBC or Cryptobriefing write-ups, so treat it as a single-outlet reading of the filing rather than a settled fact.
The named federal victim list is consistent across CNBC (OUTLET), The Record (OUTLET), and Cryptobriefing (OTHER): Federal Reserve, U.S. Senate, DOJ, NASA, Energy, HHS, and NIH. The affidavit also describes non-federal victims spanning hospitals, telecommunications providers, power companies, financial institutions, and defense contractors. No source gives a victim count, a record count, or a data volume for any of them. Anyone publishing a number for this incident today is inventing it.
One of the eight sources supplied for this brief, the Journal Record item on the same takedown, returned only site navigation content and no substantive reporting, so it contributes nothing beyond confirming the story ran on the wire.
What Was Taken
Unknown, and the DOJ explicitly declined to say. CNBC states plainly that "the DOJ did not detail the damage to the agencies or other targets from the computer intrusions." No source in this set describes exfiltrated data types, classification levels, monetary policy material, supervisory records, or personal information tied to the QScan/QTRouter operation. There is no notification, no regulator filing, and no breach disclosure.
This matters for how the Federal Reserve angle gets read. "Victim of computer intrusion by the platforms" is the language in the filings. It establishes access and targeting. It does not, on the current record, establish what left the building.
There is a separate and better-documented data loss problem at the Fed involving China, and it should not be conflated with this intrusion. The Epoch Times reports that John Harold Rogers, a senior adviser in the Fed Board's international finance division from 2010 to 2021, was sentenced on July 15, 2026 to 38 months in prison plus 12 months of supervised release for lying to investigators about sharing sensitive economic information with Chinese intelligence operatives. He was convicted February 3 on the false statements charge and acquitted of conspiracy to commit economic espionage. That is an insider case with a human handler relationship dating to 2017, not a QTFY network intrusion. Two distinct threat vectors, same target, same adversary nation.
Why It Matters
The strategic read here is about obfuscation infrastructure, not about any one victim. QTRouter's entire purpose was making attribution fail. The Record describes it as an obfuscation network that made attacks appear to originate from any infected device, and notes the tools let Chinese actors make intrusions look like they came from other countries and in some cases like the work of local attackers. Every organization that investigated an intrusion between 2018 and now and concluded "domestic actor" or "unrelated third country" on the basis of source IP may be carrying a bad finding in its incident history.
The Federal Reserve's presence on the list also lands on top of a documented governance problem. American Banker reported on the Fed OIG's 40-page report released July 16, 2026, which found the Board's "insider risk management activities do not proactively or effectively identify and manage risks to the agency's information and assets" and are "not consistent with leading practices." Central Banking's coverage of the same report, dated July 17 and citing a July 15 release, adds that the Board lacked a process for identifying its critical assets. Central Banking gives the release date as July 15 and American Banker as July 16; the discrepancy is trivial but worth noting since both describe the same document. An institution that cannot enumerate its own critical assets cannot scope the blast radius of an intrusion it just learned about from a DOJ affidavit.
There is a downstream supervisory dimension too. American Banker reported on July 17 that the Fed, FDIC, and OCC issued a joint statement letting banks ask that their most sensitive examination records stay off government systems, with a 72-hour breach notification pledge. The categories in play are network diagrams and schematics, detailed penetration test results, technical details of specific IT control weaknesses, and succession plans. The statement carries no enforceable right, and Julie Andersen Hill, dean of the University of Wyoming College of Law, told the outlet banks "will not be able to sue to enforce the document," with the pledge's only force being the trust agencies build by honoring it. That posture was set in July. A federal announcement in August naming the Fed as an intrusion victim is a live test of it.
The Attack Technique
The two platforms performed different halves of one operation. Per the DOJ affidavit as reported by The Record, QScan scanned for and automatically infected internet of things devices worldwide, building the pool. QTRouter then used that pool as a relay network, routing operator traffic through compromised devices so that intrusions appeared to originate from whichever infected host was in front. Cryptobriefing describes the same function in less technical terms, as layered misdirection making source tracing exponentially harder.
Notably, none of the sources describe the initial access technique used against the Federal Reserve or any other named agency. QScan and QTRouter are the delivery and concealment layer. The exploitation method against the actual federal targets is not in any of this reporting. The IoT infection mechanism, likewise, is described only as automatic scanning and infection, with no CVEs, no device families, and no indicators of compromise published in these sources.
The FBI action was a domain seizure, per CNBC, which disrupts the platforms' command infrastructure. It does not remediate infected IoT devices already in the relay pool, and it does not evict any operator persistence inside victim networks. Leatherman's description of QTFY as operating "within a complex network of hackers-for-hire and government clients in China" points at a contractor ecosystem where the same people rebuild under a new name.
What Organizations Should Do
- Re-examine attribution on past incidents. Any intrusion since 2018 attributed to a domestic or unexpected-country source based primarily on IP geolocation deserves a second look. QTRouter was purpose-built to produce exactly that wrong answer.
- Inventory and segment IoT. The infection pool was built from internet-exposed IoT devices. Enumerate cameras, sensors, printers, building controls, and network appliances; get them off flat networks and off direct internet exposure; and confirm they are not acting as egress relays.
- Hunt for outbound relay behavior, not just inbound exploitation. A compromised device in this model is a transit node. Look for unexpected persistent outbound connections and traffic volumes from devices that should be near-silent.
- Close the insider risk gap the Fed OIG described. Identify critical assets first, because insider risk management that cannot name what it is protecting is theater. The Rogers case shows the human vector runs in parallel with the network one against the same targets.
- For banks: exercise the new examination records option. The July joint statement lets you ask examiners to read network diagrams, penetration test results, and IT control weakness details on your systems rather than copying them to government ones. It is unenforceable, so use it proactively and document the request.
- Assume no victim notification is coming. The DOJ published no damage assessment and no IOCs in this announcement. Do not wait for a formal notification to start hunting.
Sources: US seizes Chinese hacking tools after alleged Federal Reserve breac... | Fed, NASA and DOJ among victims of China hacker group: Court documents | US takes down alleged Chinese hacking tools used against Federal Re... | Fed officials mishandled sensitive information: Watchdog report Am... | Regulators answered half of banks' data-security asks American Banker | U.S. disrupts Chinese hacking operation targeting ... | Ex-Fed Adviser Sentenced to 38 Months for Passing Sensitive Info to... | Fed watchdog issues warning after Chinese espionage case - Central...