Technology
US seizes domains linked to Chinese botnet used to target federal agencies
Court documents reveal state-sponsored hackers used a large-scale botnet to target U.S. government entities, defense contractors, and critical infrastructure.
The short version
- The U.S. Department of Justice and FBI seized court-ordered domains used to operate a Chinese state-sponsored botnet, disabling its command servers.
- The hacking operation targeted high-profile U.S. entities including NASA, the Federal Reserve, the DOJ, the U.S. Senate, hospitals, and defense contractors.
- Court filings state the botnet was operated by Nanjing Xinjiuwei Network Technology Company and its group QTFY, which provided hacking services to Chinese state security and military entities.
- U.S. officials have not detailed the extent of the damage caused by the computer intrusions.
Key facts
- The FBI executed court-ordered domain seizures to render a Chinese state-sponsored botnet and its command-and-control servers inoperable.[TechCrunch · CNBC]
- U.S. entities targeted by the botnet's hacking platforms include the Federal Reserve, NASA, the U.S. Senate, the DOJ, the Department of Energy, Health and Human Services, and the NIH.[TechCrunch · CNBC]
- The hacking activity dates back to 2018, with intrusions into the U.S. Senate occurring as recently as 2026.[TechCrunch]
- According to court documents unsealed in California, the hacking group QTFY was employed by Nanjing Xinjiuwei Network Technology Company.[TechCrunch · CNBC]
- The Justice Department stated that QTFY's customers included China's Ministry of State Security and the People's Liberation Army.[TechCrunch · CNBC]
- Network company Lumen shared threat intelligence with the FBI after tracking the hacker group profiling defense, aerospace, and government targets over the past year.[TechCrunch]
What remains uncertain
- The Department of Justice did not disclose the specific scope of data accessed or total damage caused by the intrusions.[CNBC]