(WASHINGTON) — The Justice Department and FBI said a Chinese government-backed hacking group has for years engaged in targeted attacks against hundreds of entities in the United States including NASA, National Institutes of Health, the Department of Health and Human Services, the Justice Department, the Department of Energy, the U.S. Senate and the Federal Reserve.
According to a DOJ statement and an affidavit unsealed Wednesday in federal court in California, a group known as “QTFY” — which includes former members of China’s military — has used its infrastructure to compromise critical infrastructure since 2018 in networks spanning from government agencies, hospitals, telecommunications providers, power companies and defense contractors.
As part of their efforts to expose and disrupt the group, prosecutors successfully seized three internet domains affiliated with the Chinese company, Nanjing Xinjiuwei Network Technology Company, and multiple advisories have been issued to companies and other federal agencies so that potential victims of the group can better protect themselves from future attack.
In the seizure warrant, prosecutors say that in September 2024, QTFY hackers “conducted computer intrusions” at three Energy Department laboratories, NIH, an HHS agency as well as an unnamed U.S. security device manufacturer. The group is further alleged to have attempted a hack against NASA in 2019, though court documents do not suggest that the effort was successful.
The court documents do not state clearly the scale of the attacks against several of the other government agencies identified as victims or the group’s level of success in infiltrating specific networks.
“Today’s announcement demonstrates the Justice Department’s steadfast commitment to going on the offensive against cyber threats to the national security,” said Assistant Attorney General for National Security John Eisenberg in a statement announcing the seizures. “These court-authorized seizures deny PRC-linked hackers access to tools they use to mount online attacks against our Nation’s critical infrastructure.”
The FBI and National Security Agency released an advisory with indicators of QTFY activity. Also, Lumen Technologies’ threat intelligence group, Black Lotus Labs, published a description of QTFY’s tactics, techniques and procedures to help thwart future hacks.
While the U.S. says it has exposed and disrupted this major Chinese cyber-espionage campaign, China’s cyber operations against the United States remain “relentless,” said Javed Ali, a former senior director for counterterrorism at the National Security Council.
“China has been using cyber operations against the United States for probably 20 years through a relentless campaign of operations that have involved multiple targets, multiple attack methods, and nothing the U.S. has done to date seems to be deterring this activity because it is it has existed for so long and this goes over multiple administrations here in the United States,” Ali told ABC News.
Whether China is attempting to hack into telecommunications companies, attempting to breach water systems or waging a broader campaign of trade secret theft, China’s actions reveal a clear pattern, Ali said.
“[China] just uses different tools against different targets here in the United States, and they do not appear to be deterred, even when there are disruptions or people get indicted,” Ali, now an associate professor at the University of Michigan Ford School of Public Policy, said. “None of this is stopping China’s strategic efforts of targeting the U.S. with these cyber operations.”
Copyright © 2026, ABC Audio. All rights reserved.
