The FBI and Justice Department have revealed that a Chinese government-backed hacking group, known as QTFY, has been targeting U.S. government agencies and critical infrastructure for years. The group, which includes former members of China's military, has compromised networks at agencies like NASA, the National Institutes of Health, the Department of Energy, the Federal Reserve, and the U.S. Senate since 2018. Prosecutors have seized three internet domains linked to Nanjing Xinjiuwei Network Technology Company and issued advisories to help potential victims protect themselves.
In September 2024, QTFY hackers conducted intrusions at three Energy Department laboratories, NIH, an HHS agency, and an unnamed U.S. security device manufacturer. The group also attempted to hack NASA in 2019, though court documents do not confirm its success. The scale and success of attacks against other agencies remain unclear.
Assistant Attorney General for National Security John Eisenberg stated that the seizures deny PRC-linked hackers access to tools used for online attacks against critical U.S. infrastructure. The FBI and National Security Agency, along with Lumen Technologies' Black Lotus Labs, have released advisories detailing QTFY’s tactics to help prevent future hacks.
Despite the U.S. efforts to disrupt the campaign, former National Security Council senior director Javed Ali described China's cyber operations as relentless. Ali noted that China has targeted various sectors, including telecommunications, water systems, and trade secrets, with no apparent deterrence from previous disruptions or indictments.