US seizes domains in Chinese espionage operation targeting federal agencies since 2018

AI digestMimile.ai EditorialAugust 27, 2026 at 12:35 AM

This digest was compiled by AI from multiple sources — links to the originals are below.

US seizes domains in Chinese espionage operation targeting federal agencies since 2018

Federal authorities on Wednesday disrupted a Chinese state-sponsored espionage operation that compromised multiple US federal agencies and critical infrastructure since 2018. Officials seized three domains linked to the group QTFY, cutting off access to its primary hacking platforms. The operation targeted the Departments of Energy, Justice, Health and Human Services, the Federal Reserve, NASA, and the National Institutes of Health.

Key Facts

The FBI and Justice Department identified the state-sponsored group as QTFY, which includes former members of China's military.
QTFY targeted and intruded networks of the Departments of Energy, Justice, Health and Human Services, the Federal Reserve, NASA, and the National Institutes of Health.
Officials seized three domains, cutting off access to QScan and QTRouter, the group's primary platforms.
QTFY exploited vulnerabilities in products from Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP, and BeyondTrust.
The FBI, National Security Agency, and Cyber National Mission Force released a joint cybersecurity advisory with QTFY's known indicators of compromise on Wednesday.

Operation Disruption

Federal authorities seized three domains that cut off access to QScan and QTRouter, the group's primary platforms. The FBI and Justice Department said the state-sponsored group, known as QTFY, has targeted and intruded the networks of multiple federal agencies since 2018. Officials said QTFY also attempted, but was unsuccessful, in gaining access to a U.S. election system in June. John A. Eisenberg, assistant attorney general for national security, said the court-authorized seizures deny People's Republic of China-linked hackers access to tools used to mount online attacks against the nation's critical infrastructure.

Targeted Entities

QTFY targeted the Departments of Energy, Justice, Health and Human Services, the Federal Reserve, NASA, and the National Institutes of Health. Financial institutions, defense contractors, utility companies, telecom providers, and hospitals have also been targeted by the threat group. The group unsuccessfully attempted to access the Senate in March. QTFY exploited vulnerabilities in products from Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP, and BeyondTrust.

Technical Capabilities

QTFY's full hacking suite allowed attackers to scan and exploit vulnerabilities, infect IoT devices for a botnet, and conceal or reroute traffic. The operation provided continuous reconnaissance capabilities and flexibilities designed for specific targets or objectives, according to Ryan English, information security engineer at Lumen Technologies' Black Lotus Labs. The FBI, National Security Agency, and Cyber National Mission Force released a joint cybersecurity advisory with QTFY's known indicators of compromise on Wednesday.

1 source

US seizes domains in Chinese espionage operation targeting federal agencies since 2018

cyberscoop.com

CyberScoop

Technology

FBI disrupts proxy network enabling Chinese espionage operations

The FBI disrupted infrastructure linked to a Chinese cyber espionage 'quartermaster' that provided reconnaissance, proxy management, and routing for attacks on U.S. critical infrastructure. Black Lotus Labs, Lumen Technologies' threat research arm, tracked the framework for a year and null-routed traffic to known infrastructure points. The service profiled and stole data from U.S. military, government, university, and corporate networks.

Technology

FBI, DOJ Seize Chinese Hacker Infrastructure on US Soil

The U.S. Department of Justice and FBI on Wednesday announced the seizure of websites used by Chinese state-sponsored hackers to target critical infrastructure and federal systems. The domains supported QScan, a scanning and exploit platform, and QTRouter, an obfuscation network operated by the hacking group QTFY. The group has compromised networks of government agencies, hospitals, telecoms, power companies, financial institutions, and defense contractors.

Technology

House investigation reveals Chinese telecoms retain US network ties despite FCC ban

A House investigation has found that China Telecom, China Mobile, and China Unicom continue to maintain equipment, data-center space, and network connections in the United States, years after the FCC revoked their operating authority over national security concerns. The probe by the House China Committee revealed these remaining ties could expose sensitive US network traffic to Chinese intelligence and support malicious infrastructure. The findings come amid the Salt Typhoon espionage campaign, where China Mobile’s network was linked to routing data used by the attackers.

Technology

Dream: AI agents compromise 85 Taiwan government accounts in four-day attack

AI agents compromise at least 85 Taiwanese government accounts and steal more than 2,500 personnel records during a four-day campaign in July, according to cybersecurity firm Dream. The operation uses up to eight autonomous sub-agents in 12 attack waves and expands to Taiwan's nuclear safety agency and more than half a dozen energy companies. Taiwan's Ministry of Digital Affairs confirms the attack targeted its infrastructure.

US seizes domains in Chinese espionage operation targeting federal agencies since 2018

Key Facts

Operation Disruption

Targeted Entities

Technical Capabilities

Read more

Read more