The Justice Department says a China-linked operation targeted sensitive US government networks, including NASA and the Senate.
US authorities seized domains associated with QScan and QTRouter, which investigators say were used in the campaign.
The alleged activity spans years, while China has rejected the US claims and accused Washington of smearing Beijing.
The United States on Wednesday said it had disrupted a Chinese hacking operation responsible for break-ins and attempted intrusions at the Justice Department, NASA, the Federal Reserve, the Senate and other sensitive government agencies.
According to Reuters, the US Justice Department said it had seized domains used by two hacking platforms, QScan and QTRouter, which it said were part of the campaign. The department said the platforms were operated by Nanjing Xinjiuwei Network Technology Company, a China-based firm whose clients, according to the Justice Department, included China’s civilian intelligence agency, the Ministry of State Security, and the People’s Liberation Army.
An affidavit filed by US authorities identified the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and four unnamed companies in the US and South Korea among the hackers’ victims.
The Chinese Embassy in Washington said it was not familiar with the specific details cited in the Justice Department statement. A spokesperson said the "Chinese government firmly opposes and combats all forms of cyberattacks in accordance with the law."
The spokesperson also said the US uses cybersecurity issues to "smear or discredit China", and that China "opposes the U.S. overstretching the concept of national security and using it as a pretext to impose discriminatory restrictions on Chinese companies and will firmly safeguard the legitimate rights and interests of Chinese companies."
Hacking campaign stretches back to 2018
The affidavit said the hackers had used tools they developed to compromise critical infrastructure and other sensitive networks in the US and around the world since at least 2018. It also noted that not all attempts to gain access had succeeded.
In August 2019, the hackers unsuccessfully attempted to gain access to NASA networks by targeting a vulnerability in a virtual private network, the affidavit said.
The campaign included more recent intrusions. In September 2024, the hackers carried out intrusions at three unnamed Energy Department laboratories, the NIH, an unnamed HHS agency and a US security device manufacturer, according to the affidavit.
A joint cybersecurity advisory issued by the FBI, NSA and US Cyber Command's Cyber National Mission Force detailed multiple hacking efforts over the years. Reuters reported that these included successful data theft from unnamed defence contractors, financial institutions and universities in May 2024.
The hackers also scanned for vulnerabilities and made unsuccessful attempts to access networks belonging to the US Senate and an unnamed US hospital in March 2026, according to the affidavit.
NASA said it does not comment on specific incidents, while the Department of Health and Human Services referred questions to the Justice Department. The DOJ did not respond to a request for additional detail.
Chinese-linked cyber activity
The latest allegations come amid a series of Chinese-linked hacking campaigns that have compromised sensitive US government and private-sector networks in recent years.
In March, the FBI notified Congress that hackers had penetrated certain agency networks connected to people under FBI investigation. Public reporting later attributed the compromise to China.
Chinese-linked hackers have also been tied to a compromise of certain US House of Representatives committee networks, as well as multiple major telecommunications companies in recent years.
The Justice Department said Nanjing Xinjiuwei operated the QScan and QTRouter platforms. The company did not immediately respond to a request for comment outside normal business hours.
Experts who follow Chinese cyber activity say private contractors routinely carry out high-profile intrusions on behalf of various Chinese government agencies.
"Over the last decade, the number of companies offering niche offensive services has exploded," said Dakota Cary, a China analyst with cybersecurity company SentinelOne.
