The FBI and the Department of Justice have seized and disrupted infrastructure belonging to a Chinese espionage group known as QTFY (also tracked as QT or QTCYBER). The group operated two hacking platforms — QScan and QTRouter — that functioned as a technical “quartermaster” service: providing reconnaissance, proxy management, and operational routing to support Chinese state cyber espionage operations against U.S. targets.
Among QTFY’s confirmed targets were some of the most sensitive institutions in the United States: NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate. Court documents show that the threat group includes former members of China’s People’s Liberation Army and that the company behind the infrastructure, Nanjing Xinjiuwei, received payments from China’s Ministry of State Security — making clear that the hacking was conducted on behalf of the Chinese government. Three domains linked to the operation have been seized and now display law enforcement takedown banners.