An unsealed FBI affidavit filed in California federal court alleges that a Chinese state-sponsored group tracked as QTFY penetrated a broad slice of the US federal government between 2018 and 2026, including networks tied to NASA, the Department of Justice, the Federal Reserve, the US Senate, the Department of Energy, the Department of Health and Human Services and the National Institutes of Health. The Justice Department and FBI announced on Wednesday, 26 August 2026 that they had obtained a court order and seized domains underpinning two hacking platforms, QScan and QTRouter, which DOJ said were "used to target U.S. critical infrastructure and other sensitive networks." Notably, neither the DOJ statement nor the affidavit quantifies what was taken or what damage resulted, a gap that every outlet covering the case flagged independently.
What Happened
The core of the case is a takedown, not a victim notification. DOJ said it seized the domains behind QScan and QTRouter, platforms it attributes to QTFY, a China-based group that court filings say was employed by Nanjing Xinjiuwei Network Technology Company. According to the DOJ statement as reported by CBC and The Independent, Nanjing Xinjiuwei's client list included China's Ministry of State Security, the civilian intelligence service, and the People's Liberation Army. PCMag reports that the affidavit further states QTFY's ranks include former PLA members who leverage those relationships to win contracts and subcontracts supporting offensive cyber operations.
Accounts differ on the scale of the seizure itself. CNBC, Reuters, CBC and The Independent describe the action as the seizure of domains used by two hacking platforms without giving a count. Internewscast and PCMag both specify three internet domains. The two-platform, three-domain framing is not necessarily contradictory, but the precise number comes only from OTHER-tier sources and should be treated as unconfirmed.
The victim list also varies by source. Reuters, CBC, The Independent and Global News consistently name DOJ, NASA, the Federal Reserve and the Senate in the lede, with the affidavit separately identifying the Department of Energy, HHS, NIH and four unnamed companies in the United States and South Korea. CNBC adds that a court filing describes other targeted networks as belonging to hospitals, telecommunications providers, power companies, financial institutions and defense contractors. Internewscast is the only source specifying three Department of Energy national laboratories rather than the department generally, and is the only source reporting an associated international money laundering conspiracy tied to the domains. Both claims sit on a single OTHER-tier source and are not corroborated elsewhere in this set.
Reuters is also more careful than most on the intrusion outcome, describing the campaign as "break-ins and attempts" against the named agencies. That distinction matters: not every named organisation is necessarily a confirmed compromise, and the government has not published a per-victim breakdown.
What Was Taken
Nothing has been quantified. This is the single most important caveat in the entire story, and it is confirmed by the strongest sources in the set rather than inferred. CNBC states flatly that "the DOJ did not detail the damage to the agencies or other targets from the computer intrusions." Internewscast, reviewing the unsealed documents, says they "offer limited information about what the intruders sought or whether the breaches caused measurable damage."
There is no record count, no data-type inventory, no classification level and no claim of exfiltration volume anywhere in the eight sources. Anyone publishing a figure at this stage is inventing it. What the filings do establish is a duration of exposure rather than a payload: access spanning 2018 to 2026, roughly eight years, across agencies holding aerospace research, law enforcement case data, monetary policy and payments infrastructure, federal health and biomedical research data, and national laboratory work. The sensitivity of the target set is the story; the loss inventory is still unwritten.
Note also that a domain seizure is a disruption action, not a damage assessment. Affected agencies may issue their own notifications later, and those are the documents that will carry actual scope.
Why It Matters
Three things distinguish this from routine espionage reporting.
First, dwell time. An eight-year window against Treasury-adjacent, aerospace and law-enforcement networks implies persistence that survived multiple administrations, multiple CISA directive cycles and presumably several rounds of incident response at the affected agencies. Whatever detection existed did not close the door.
Second, the contractor model. The filings describe a commercial layer between the state and the operators: QTFY builds and runs tooling, Nanjing Xinjiuwei employs the group, and MSS and PLA sit as clients. This is the same hack-for-hire structure seen in prior Chinese-nexus disclosures, and it means attribution to a company name does not bound the operational tasking. The tooling is a product with multiple customers.
Third, the target spread beyond government. CNBC's citation of the court filing puts hospitals, telecoms, power utilities, financial institutions and defense contractors in scope. Attorney General Todd Blanche, in comments to Fox News reported by Internewscast, said the hackers were also targeting "hospital systems and health care centers." Private-sector defenders in those verticals should not read this as a federal-only event.
The counterweight: this is a US government prosecutorial narrative built on an affidavit, which is an allegation supported by an agent's sworn statement, not adjudicated fact. The Chinese Embassy in Washington did not respond to requests for comment from Reuters, CBC or The Independent, and Beijing routinely denies responsibility for hacking activity.
The Attack Technique
The clearest technical description comes from PCMag's reading of the affidavit, which is OTHER-tier and should be attributed rather than asserted. PCMag reports that the operation ran through a network of hijacked IoT devices including routers, security cameras and smart appliances, used to obscure the true origin of the traffic. FBI Director Kash Patel's statement, quoted in The Independent, supports the obfuscation purpose in general terms: "These tools were used by PRC cyber actors to hide the origin of their attacks," and he characterised the disrupted asset as "a global botnet and hacking platform."
On the two platforms, PCMag reports the affidavit describes QScan as a tool that "scans and automatically infects" targets, with QTRouter as the companion component; the naming strongly implies router compromise and proxy relay, though the sources do not spell out QTRouter's function in full. PCMag additionally attributes to the FBI a pattern of scanning for network vulnerabilities and exploiting VPN-related flaws to gain entry to federal agencies. No CVEs, malware family names, hashes or IP indicators appear in any of the eight sources, and no IOC package has been published in what is available here.
Blanche's statement, via Internewscast, refers to law enforcement having "investigated and disabled the PRC's malicious software," suggesting a technical remediation component beyond the domain seizure, similar to prior FBI court-authorised botnet cleanup operations. The scope of that disabling action is not described.
What Organizations Should Do
- Hunt backwards, not forwards. A 2018 start date means your retention window is almost certainly shorter than the intrusion. Prioritise any long-lived artifacts that outlast log retention: unexplained service accounts, stale VPN certificates, orphaned scheduled tasks, and SSH or API keys with no clear owner.
- Treat edge and IoT as attack surface, not appliance. Inventory internet-facing routers, IP cameras, building management and smart-appliance devices. Pull them off flat networks, change default and shared credentials, patch or replace end-of-life units, and alert on any such device initiating outbound connections to unexpected destinations.
- Audit the VPN and remote access tier hard. PCMag's account puts VPN flaw exploitation in the initial access chain. Confirm every remote access appliance is on a current firmware branch, enforce phishing-resistant MFA, and review authentication logs for successful logins from residential or IoT-adjacent IP space, which is exactly what a proxy network of hijacked consumer devices looks like on the wire.
- Assume proxied traffic defeats geo-blocking. If the relay layer is compromised US and allied consumer hardware, country-based blocking and "domestic IP therefore benign" heuristics provide no protection. Shift detection weight to behavioural and identity signals.
- Extend scope to the named verticals. Healthcare, telecom, power, financial services and defense contracting were explicitly listed in court filings as target sets. If you operate in one, run this as a threat hunt, not a news item.
- Wait for, and then act on, per-victim notifications. No data loss has been quantified. Do not build an incident narrative or a customer communication on a record count that does not exist in any source. Watch for follow-on agency statements and any CISA advisory carrying actual indicators.
Sources: Chinese Hackers Breached NASA, DOJ and US Systems: Affidavit | Fed, NASA and DOJ among victims of China hacker group: Court documents | Chinese hackers disrupted U.S. Justice Department, NASA ... | US says Chinese hackers broke into Justice Department ... | Fed, NASA and DOJ among victims of Chinese state-sponsored hacker g... | U.S. says Chinese hackers accessed DOJ, NASA, other sensitive agenc... | US claims Chinese hackers breached Justice Department, Federal Rese... | US: China Hijacked IoT Devices to Breach NASA, Federal Agencies