Michael Kan

Principal Reporter

OUR EXPERT

When he's not battling bugs and robots in Helldivers 2, Michael is reporting on AI, satellites, cybersecurity, PCs, and tech policy.

Edited By:

Chloe Albanesius

August 26, 2026

Add as a preferred source on Google

(Credit: Greggory DiSalvo via Getty Images)

The US says it uncovered Chinese state-sponsored hackers infiltrating several federal agencies via a network of hijacked IoT devices, including routers, security cameras, and smart appliances.

On Wednesday, the Justice Department and the FBI announced they had secured a court order to shut down three internet domains linked to the hacking operations. Victims included NASA, the Department of Energy, the Federal Reserve, and the DOJ, among others.

(Credit: FBI/DOJ)

The US uncovered the operation while investigating a mysterious group based in China, dubbed QTFY, that has been developing hacking tools since 2018. “QTFY actors include former members of the [China’s] People's Liberation Army (PLA), and they use their PLA relationships to obtain contracts and subcontracts supporting offensive cyber operations,” according to a US affidavit used to obtain the court order.

You May Also Like

The FBI has also connected QTFY to hacking efforts dating back eight years, including scanning for network vulnerabilities and exploiting VPN-related flaws to break into federal agencies. In addition, federal agents claim that a Chinese company, Nanjing Xinjiuwei Network Technology Company, has been employing the QTFY group and has business relationships with China’s Ministry of State Security.

Wednesday’s announcement specifically accuses QTFY of creating two hacking platforms, QScan and QTRouter. “QScan scans and automatically infects thousands of ‘internet-of-things’ (IoT) devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices,” the Justice Department says.

QScan also contains a “database of over 200 proof-of-concept exploits” written in Python computer code and was “designed for large-scale employment,” the FBI says. “On a single day in 2024, for example, QScan processed over two million scanning and penetration testing tasks.”

Meanwhile, QTRouter used commercial proxies and virtual private servers to mask that hackers based in China were accessing the infected IoT devices. “QTRouter hides a user's true IP address by routing the user's network traffic through various IP addresses,” the affidavit added.

(Credit: DOJ)

Together, the two platforms formed a botnet, or an army of secretly hijacked computers across the globe that the Chinese hackers could exploit to stage their activities. Federal investigators claim QTFY offered its computer hacking services to paying customers, “including the PRC’s Ministry of State Security and the People’s Liberation Army.”

Recommended by Our Editors

Hacker Hijacks Downloads for Popular PC-Monitoring Tools to Serve Malware

GOP Lawmakers Accuse China of Bankrolling US Data Center Protests

FBI: Hackers Are Targeting US Industrial and Water Systems With Help of AI

One of the hacking campaigns occurred in September 2024, when QTFY carried out computer intrusions against several government agencies and an unnamed “US security device manufacturer” by exploiting a zero-day vulnerability in the Ivanti Cloud Services Appliance.

To hit back, the Justice Department secured a court order to take over qtproxy.xyz, qt-proxy.org, and qt-team.com. “Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable,” the department said.

Hence, the crackdown should free the affected IoT devices. Still, the FBI has issued a 36-page advisory about QTFY, warning that its activities have also targeted the defense, telecommunications, and higher education sectors. The advisory includes indicators of compromise, providing a way for companies and organizations to determine whether they were affected.

About Our Expert

Michael Kan

Principal Reporter

Experience

I've been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I'm currently based in San Francisco, but previously spent over five years in China, covering the country's technology sector.