The Justice Department and FBI have seized domains tied to two hacking tools built and run by a Chinese state-sponsored group, cutting off access to malware that had been used against U.S. government agencies for years.
The tools, known as QScan and QTRouter, were developed by a group called QTFY, which court documents tie to a Nanjing-based company. According investigators, QTFY sold hacking services to paying customers, among them China’s Ministry of State Security and the People’s Liberation Army.
NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate are among those targeted by QTFY’s intrusion activity.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise,” said Attorney General Todd Blanche. “Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China.”
QScan and QTRouter worked as a pair. QScan hunted down and infected internet-of-things devices around the world, folding them into a network run by QTFY. QTRouter then combined those hijacked devices with commercial proxy services and rented virtual servers to build what investigators call an obfuscation network. The setup let QTFY route its attacks through machines outside China, including ones planted near the networks it was targeting, so the traffic looked like it came from somewhere else entirely.
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable,” the DoJ wrote.
FBI Director Kash Patel framed the takedown as part of a broader push against Chinese-linked cyber operations. “These tools were used by PRC cyber actors to hide the origin of their attacks,” he said.
This is the latest in a series of operations directed against hacking activities by the People’s Republic of China.
In 2025, the FBI stripped PlugX malware from more than 4,000 U.S. computers infected by the group Mustang Panda. A year earlier, it disabled a botnet built from hundreds of thousands of infected IoT devices that Flax Typhoon was leasing out to Chinese government customers. Before that, in 2023, it took down a separate botnet that Volt Typhoon used to mask its intrusions into U.S. and foreign infrastructure.
Alongside the seizure announcement, the FBI and NSA published an advisory listing indicators of compromise tied to QTFY. Threat intelligence researchers at Lumen Technologies’ Black Lotus Labs also released their own writeup of the group’s tactics.
“We’re taking the fight to PRC sponsored cybercriminals to protect the critical services Americans rely on every day,” added U.S. Attorney Adam Gordon for the Southern District of California.