US Justice Department seizes domains it says Chinese state-sponsored hackers used to infiltrate systems at NASA, Senate, Federal Reserve, and more — FBI moves forward with domain seizures

The U.S. Department of Justice and FBI revealed in a statement Wednesday that it had seized domains related to platforms that it claims were operated by China state-sponsored hackers. The press release says the Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, NIH, NASA, and U.S. Senate all experienced “computer intrusion activity.”

The Justice Department says a state-sponsored group known as QTFY is responsible for the intrusion, which the U.S. government claims came to be through two pieces of malware: QTRouter and QScan. The release says the People’s Republic of China (PRC) Ministry of State Security was among QTFY’s paying customers.

According to the U.S. government, QScan “scans and automatically infects thousands of [IoT] devices worldwide.” Those devices are then added to the QTRouter network. It’s a botnet, but the Justice Department also calls it an “obfuscation layer” to mask the origin of malicious traffic. QTFY’s system has been used to compromise U.S. critical infrastructure since 2018, according to the affidavit.

The group is said to be employed by the Nanjing Xinjiuwei Network Technology Company, which we were unable to find any information on.

As part of the action, the Justice Department seized three domains: qtproxy.xyz, qt-proxy.org, and qt-team.com. Those domains now show the seizure notice you can see below.

The investigation into the group began as early as 2019, when the FBI looked into a system intrusion at NASA related to the CVE-2019-11510, which was subsequently patched. The FBI traced the activity back to two Gmail accounts and a phone number with a +86 country code (the code for the PRC).

The group allegedly rented infrastructure from commercial platforms, leading to a series of abuse complaints to the emails by hosting provider Hostwinds. The FBI says the group obtained the three domains it seized between 2022 and 2024, registering them with domain registrar Namecheap and paying through PayPal.

Although the PRC routinely denies hacking activities in the U.S., Chinese officials reportedly acknowledged that the government was behind a series of attacks on U.S. infrastructure late last year. In 2024, 30-year-old wiretap systems deployed by the U.S. government in telecom and internet providers were reportedly compromised by Chinese attackers.