The FBI and Department of Justice have seized a set of domains underpinning two linked hacking platforms, QScan and QTRouter, that prosecutors say a Chinese state-sponsored group used to compromise Internet of Things devices around the world and route attacks through them against sensitive U.S. targets, including NASA and the U.S. Senate.

How QScan and QTRouter Worked Together

The two tools formed a pipeline. QScan continuously scanned the internet for vulnerable IoT devices — the kind of routers, cameras, and other connected hardware that often ship with weak default credentials or unpatched firmware — and automatically infected any it found. Once compromised, those devices were folded into the QTRouter network, where they were combined with commercial proxy services and leased virtual private servers to build out routing infrastructure.

The purpose of that infrastructure, according to the DOJ, was obfuscation: by bouncing malicious traffic through hijacked consumer and small-business devices scattered across many countries, the operators could make their attacks on U.S. networks appear to originate from ordinary residential or business connections outside China, complicating attribution and defensive blocking.

Who Was Behind It

Investigators attribute the platforms to a group tracked as QTFY, which the DOJ describes as operating out of Nanjing Xinjiuwei Network Technology Company in China. According to the government’s allegations, QTFY provided hacking-as-a-service capabilities to China’s Ministry of State Security and the People’s Liberation Army — a pattern consistent with previous cases where nominally private Chinese firms have been accused of acting as contractors for state intelligence and military hacking operations.

High-Value Targets

The list of organizations the DOJ says were targeted through this infrastructure reads like a roster of high-priority U.S. institutions: NASA, the Federal Reserve, the Department of Energy, the Department of Justice itself, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. That breadth suggests the botnet was used less as a one-off tool and more as standing infrastructure, available to support a range of espionage and intrusion campaigns against government and critical-sector networks over time.

How the Takedown Happened

Rather than attempting to seize every infected device individually — an impractical task given how widely IoT bots are distributed — investigators went after the platforms’ weak point: domain names hard-coded directly into the QScan and QTRouter malware. Those domains, the DOJ noted, “supported essential malware functions, including communications and authentication,” meaning that seizing them cuts the infected devices off from their controllers and breaks the chain that let operators issue commands or route traffic through the network.

Attorney General Todd Blanche framed the action as part of a broader posture toward state-linked hacking, saying the United States would “use every available tool to stop state-sponsored hackers targeting critical infrastructure.” FBI Director Kash Patel described the operation as the “disruption of a global botnet and hacking platform used by Chinese state-sponsored actors.”

What It Means Going Forward

Domain seizures are a disruption, not necessarily a permanent kill. Operators of botnets built this way often attempt to rebuild using new infrastructure, and any devices already compromised remain vulnerable until their owners patch or replace them. For organizations — and even home users — the underlying lesson is a familiar one: unmanaged or unpatched IoT devices continue to be a preferred on-ramp for state-linked actors looking to build anonymizing infrastructure, not just criminal botnet operators. Keeping firmware updated, changing default credentials, and segmenting IoT devices away from sensitive network segments remain some of the most effective defenses against being unwittingly conscripted into campaigns like this one.

The case also fits a wider pattern U.S. officials have described repeatedly over the past several years: nominally commercial Chinese technology and security firms allegedly acting as contractors for state intelligence and military hacking programs, blurring the line between criminal botnet infrastructure and state-directed espionage tooling. Treasury and Justice Department actions against similar front companies suggest this takedown is unlikely to be the last, even as attribution and legal action against operators based in China remains difficult to enforce in practice.