The Justice Department shut down two Chinese state-sponsored hacking platforms that penetrated at least seven federal agencies, including the U.S. Senate and the Federal Reserve, and the full extent of the damage remains undisclosed.
Federal prosecutors unsealed court documents in the U.S. District Court for the Southern District of California on Wednesday revealing that a hacking group designated "QTFY," operating out of a firm called Nanjing Xinjiuwei Network Technology Co. in Nanjing, China, built and ran two malware platforms, QScan and QTRouter, that were used to break into some of the most sensitive networks in the American government. The DOJ seized internet domains hard-coded into both platforms, rendering them inoperable.
The list of victims reads like a directory of the federal government's most critical operations. Court filings name the Federal Reserve, the U.S. Senate, NASA, the Justice Department itself, the Energy Department, the Department of Health and Human Services, and the National Institutes of Health. Beyond government targets, the filings note that "other targeted networks include those operated by hospitals, telecommunications providers, power companies, financial institutions, and defense contractors."
Attorney General Todd Blanche framed the action as part of a sustained counteroffensive. Breitbart News reported Blanche's statement describing the seizure as "the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People's Republic of China."
"State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise."
The DOJ did not disclose what data was accessed, how long the platforms had been operational, or the full scope of damage caused by the intrusions. No arrests were announced in connection with the QScan and QTRouter operation.
Court documents identified QTFY's paying customers: the People's Republic of China's Ministry of State Security and the People's Liberation Army. That means two of Beijing's most powerful intelligence and military arms were bankrolling a private Chinese firm to hack American hospitals, power grids, defense contractors, and the halls of Congress.
The arrangement fits a pattern that U.S. officials have flagged for years, China outsourcing offensive cyber operations to nominally private companies while maintaining state direction and funding. The DOJ's characterization of these platforms as tools used to "target U.S. critical infrastructure and other sensitive networks" leaves little ambiguity about the intent.
That the Justice Department was itself among the breached agencies underscores the breadth of the campaign. The nation's chief law enforcement body was simultaneously investigating the hackers and listed among their victims.
The administration's broader posture on national security threats has generated friction on multiple fronts. Recent White House efforts to crack down on leakers of sensitive information reflect a government acutely aware of how exposed its internal operations have become, whether the threat comes from foreign hackers or domestic breaches.
The domain seizure landed the same day as another reminder of China's multi-pronged espionage campaign against the United States. The U.S. Attorney's Office for the District of Columbia announced that John Harold Rogers, a 64-year-old former senior adviser to the Federal Reserve Board of Governors from Vienna, Virginia, was sentenced to 38 months in federal prison and 12 months of supervised release.
Rogers' crime: lying to government investigators about sharing sensitive Federal Reserve economic information with Chinese spies. Court papers said that during decades of service at the Fed, Rogers had access to restricted information about monetary policy and was entrusted with confidential data. He chose to pass it along to Beijing's operatives, then lied about it when confronted.
U.S. Attorney for the District of Columbia Jeanine Pirro did not hold back in a video posted Wednesday.
"He sold out his country and other members of the Federal Reserve Board, and he hid behind a lie."
Pirro said the sentence was one of the longest ever handed down for providing false statements to federal investigators, a signal that the DOJ intends to treat espionage-adjacent conduct with the severity it demands.
The Rogers case and the QScan seizure, announced on the same day, paint a picture of a Chinese intelligence apparatus working every angle, hacking from the outside while cultivating insiders willing to betray their positions of trust. The Fed was hit from both directions.
The attorney general's language, "the latest in a series", suggests the DOJ has conducted prior technical operations against PRC-sponsored hacking infrastructure. He did not specify which operations he was referencing, or how many have been carried out.
The gaps in the public record are significant. The DOJ has not said what specific systems were compromised at the Senate, NASA, or the other targeted agencies. It has not said whether classified material was exfiltrated. It has not said how long QTFY operated before the domains were seized. And it has not announced charges against any individuals tied to the hacking group itself, only the seizure of infrastructure.
Those unanswered questions matter. Taxpayers and lawmakers deserve to know whether the breach of the U.S. Senate compromised legislative communications, whether the Federal Reserve intrusion touched monetary policy data beyond what Rogers allegedly handed over, and whether the Energy Department breach reached nuclear-related systems. The DOJ's silence on damage assessment is conspicuous.
The threat from Chinese cyber operations has become a recurring theme in national security discussions on Capitol Hill. Senior Republican senators have pressed the DOJ on a range of accountability questions in recent months, and the scope of Beijing's penetration into federal systems adds urgency to those demands.
Meanwhile, the government's own internal security posture has faced scrutiny from multiple directions. The Secret Service recently suspended three communications officials over a leak probe tied to presidential security details, a reminder that protecting sensitive information requires vigilance against threats both foreign and domestic.
Strip away the legal language and the bureaucratic framing, and the facts are stark. A private Chinese company, funded by Beijing's spy service and military, built hacking tools that penetrated the U.S. Senate, the Federal Reserve, NASA, the Justice Department, the Energy Department, HHS, and NIH. The same tools targeted hospitals, power companies, telecom providers, financial institutions, and defense contractors.
The DOJ seized the domains. The platforms went dark. But no one has been arrested. No damage assessment has been made public. And a former Fed insider who fed sensitive economic data to Chinese intelligence received a sentence of just over three years, harsh by the standards of false-statement cases, but modest for conduct that Pirro herself described as selling out his country.
The scale of China's cyber and human intelligence operations against the United States has been an open secret in Washington for years. GOP senators have shown increasing willingness to press federal agencies and officials who resist accountability, and the revelations about QTFY's reach should sharpen that resolve.
Rendering two malware platforms inoperable is a tactical win. But Beijing's intelligence services have deep pockets, patient operators, and a demonstrated willingness to rebuild. Seizing domains is a start. Holding people accountable, on both sides of the Pacific, is the part that actually deters.
