US Accuses China-Linked Hackers Of Breaching Federal, Military Networks

United States authorities have said China-linked hackers targeted US federal government networks as well as hospitals, power companies, telecommunications providers, financial institutions and defence contractors.

The US Department of Justice and the FBI disclosed the development on Wednesday, August 26, 2026, as they announced the court-authorised seizure of three internet domains linked to tools allegedly used in the hacking campaign.

The domains, qtproxy.xyz, qt-proxy.org and qt-team.com, were allegedly used to operate two complementary platforms known as QScan and QTRouter.

According to an FBI affidavit, the hackers are known as QTFY actors and are based in China. Investigators said the group works for Nanjing Xinjiuwei Network Technology Co, a private Chinese company whose payments from China’s Ministry of State Security indicate that it conducts cyber operations on behalf of the Chinese government.

The group allegedly includes former members of China’s People’s Liberation Army who use their military connections to obtain contracts and subcontracting work supporting offensive cyber operations.

US authorities said the group’s infrastructure has been used since at least 2018 to compromise critical infrastructure and other sensitive networks in the United States and other countries.

Among the US government networks targeted were those belonging to NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services and the National Institutes of Health. The US Senate was also targeted in 2026, according to the affidavit.

Other reported targets included hospitals, telecommunications providers, power companies, financial institutions and defence contractors.

The Justice Department said QScan was designed as a vulnerability-scanning and exploitation platform, while QTRouter was used as an obfuscation network to conceal the hackers’ activities. The group also operated botnets made up of compromised internet-connected devices.

The seized domains were registered through US-based domain providers and were allegedly used in connection with activities that violated US computer and money-laundering laws. The Justice Department said the domains were therefore subject to seizure and forfeiture.

The operation is part of a broader US effort to disrupt Chinese state-linked cyber operations targeting American government and critical infrastructure networks.

The latest action comes amid growing US concerns that Chinese cyber actors are seeking persistent access to critical systems that could be exploited for espionage or disruption during a future geopolitical crisis.