By Jose E. Navarro | The Navarro Report | National Affairs
The Justice Department and FBI announced court-authorized domain seizures last month that disabled two hacking platforms built by a Chinese state-sponsored group to burrow into American critical infrastructure — the latest in a string of technical takedowns that raises a harder question for national security officials: how much of this adversary network is being neutralized, and how much is simply being replaced.
The platforms, known as QScan and QTRouter, were operated by a group federal prosecutors identify as “QTFY,” employed by the China-based Nanjing Xinjiuwei Network Technology Company. According to court documents unsealed in the Southern District of California, QTFY’s client list is not limited to private buyers: it includes the PRC’s Ministry of State Security and the People’s Liberation Army, meaning the tools functioned as hacking-for-hire infrastructure available to Beijing’s intelligence and military services alike.
The named American targets read like a list of the institutions that keep the federal government running: NASA, the Federal Reserve, the Department of Energy, the Department of Justice itself, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. Attorney General Todd Blanche said the operation reflects a broader posture shift. “State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Blanche said. “Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China.”
How the network worked
QScan and QTRouter functioned as a matched pair. QScan automatically scanned for and infected thousands of internet-connected devices worldwide — routers, cameras, and other IoT hardware with weak security — and enrolled them into QTRouter, a network that also absorbed commercial proxy services and leased virtual private servers. The combined system worked as what investigators call an obfuscation network: traffic from Chinese state hackers could be routed through a compromised device sitting inside, or near, the very network under attack, making the intrusion look domestic rather than foreign. FBI Director Kash Patel said the seizures targeted exactly that capability. “These tools were used by PRC cyber actors to hide the origin of their attacks,” Patel said. “Thanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down.”
Because the domains investigators seized were hard-coded into the malware for authentication and communication, the court-authorized takedown made both platforms inoperable in one stroke, rather than requiring agencies to chase down each infected device individually. The FBI and National Security Agency also published a joint cybersecurity advisory documenting QTFY’s tactics and indicators of compromise dating back to at least 2018, giving network defenders a way to check whether they were already compromised.
Part of a pattern, not an isolated strike
QTFY is not a standalone case. It is the fourth publicly disclosed PRC-linked infrastructure takedown in three years: the FBI disrupted a Volt Typhoon botnet in 2023, dismantled a Flax Typhoon-supplied IoT botnet in 2024, and removed PlugX malware from more than 4,000 U.S. computers infected by Mustang Panda in 2025. Assistant Attorney General for National Security John Eisenberg framed the latest action as part of a sustained offensive rather than a one-off. “Today’s announcement demonstrates the Justice Department’s steadfast commitment to going on the offensive against cyber threats to the national security,” Eisenberg said.
The operation also lands within a formal policy shift. A national cyber strategy and executive order issued in March directed the Attorney General and Homeland Security, supported by the Secretary of War, to draw on threat intelligence from commercial cybersecurity firms to sharpen attribution and disruption of foreign hacking networks — and Patel tied Wednesday’s seizure directly to that strategy, calling it evidence the FBI is “surging efforts to shape adversary behavior and defend the homeland in cyberspace.”
The accountability question
For all the operational success, the pattern itself is the warning. Four distinct PRC-linked platforms disrupted in three years, each with named federal victims, each succeeded by the next network within roughly a year, points to an adversary with more capacity to generate new infrastructure than the government has to permanently deny it. The named targets in the QTFY case — a central bank, a space agency, three cabinet departments, and the Senate itself — are hardened federal networks, and Chinese state hackers reached them anyway, repeatedly, over a period investigators trace back to 2018.
That is the through-line for taxpayers and oversight committees to watch: seizures make for a clean headline, but they measure enforcement activity, not risk reduction. Congress has not yet been told how many of the four disrupted platforms’ techniques have already reappeared under new infrastructure, nor whether the agencies named as QTFY targets have closed the access gaps that let a hacking-for-hire operation reach them in the first place. Until that accounting exists, each takedown answers a narrower question than the one that matters: not whether the government can disable a hacking platform after the fact, but whether it can keep the next one from reaching the Federal Reserve at all.
Human-Directed AI Journalism: This article was researched and drafted with AI assistance under the direction, editing, and final approval of Jose E. Navarro.