FBI Seizes Three Domains Used by China-Backed QTFY Hacking Group to Target Federal Agencies

The FBI seized three internet domains Wednesday used by Chinese government-backed hacking group QTFY to target U.S. agencies and critical infrastructure. The group, operating through Nanjing Xinjiuwei Network Technology Company, deployed QScan and QTRouter tools against NASA, the Federal Reserve, the National Institutes of Health, the U.S. Senate, and the departments of Energy, Justice, and Health and Human Services, as well as hospitals, telecom providers, power companies, banks, and defense contractors.

The seizure targets the supply chain, not the demand. QTFY sold reconnaissance and obfuscation services to China's civilian intelligence agency (MSS) and military (PLA), meaning it functioned as a shared platform — closing it creates friction for multiple PRC actors simultaneously.

But Chinese cyber operators have demonstrated rapid adaptation; the 2024 activity levels suggest QTFY was already a mature, well-resourced operation with redundancy built in. The real test is whether the FBI move is paired with Entity List action (which would block U.S. companies from providing hosting, cloud, or network services to Nanjing Xinjiuwei's successor firms) or remains a domain seizure without follow-on enforcement.

WHY IT MATTERS

QTFY's infrastructure operated at industrial scale — processing 2+ million scanning tasks in a single day in 2024 — and served as a shared platform for multiple Chinese cyber actors, meaning the seizure disrupts not one campaign but an entire targeting apparatus.

The targeting pattern (Federal Reserve, Senate, Energy Department, NIH, defense contractors) maps to economic intelligence, legislative targeting, and critical infrastructure reconnaissance — the three pillars of PRC intelligence collection against the U.S. The tool's ability to rapidly exploit zero-days at scale means defenders now face a temporary window: QTFY's replacement infrastructure will take months to rebuild, during which the targeting tempo should drop noticeably. Watch whether Treasury or Commerce designates Nanjing Xinjiuwei under OFAC or the Entity List within 30 days — that move would signal intent to choke off the company's ability to operate or resell services.

WHAT THIS DOESN’T TELL US

Did the FBI seizure actually disrupt active operations, or did QTFY operators migrate to backup infrastructure before the domains went dark? The affidavit says the tools were used 'to target' agencies, but does not confirm whether any breaches succeeded or persisted.

Fault Lines

Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.

Front page → Get the weekly brief →