China Hack Playbook Hits U.S. Nerve Centers

The same hackers who probed a U.S. election system also scanned the U.S. Senate and hit key labs and health networks—and the FBI says they ran that play for years.

Story Snapshot

Justice Department says it seized platforms tied to China-backed group QTFY.
Court filings and agency lists target across government and critical infrastructure.
Defense advisory details tools QScan and QTRouter and links to a China-based firm.
China’s embassy rejects the claims and says it opposes hacking.

What the government says happened, and why it matters

The Department of Justice and the Federal Bureau of Investigation said they seized online platforms used by a China-backed hacking group called QTFY.

The announcement described a years-long campaign that touched hundreds of U.S. targets, including the National Aeronautics and Space Administration, the Federal Reserve, the Department of Justice, and the U.S. Senate.

That is not nuisance hacking. Those names sit at the core of American power and daily life. The reach across finance, law, space, and lawmaking poses real risk, not just headlines.

China’s hacking campaign targeted NASA, the Federal Reserve, the US Senate, the Justice Department, and more, according to the DOJ. https://t.co/3Kdpl4RA4j

— WIRED (@WIRED) August 26, 2026

Court documents say the operation included both successful breaches and failed attempts. In 2024, reported victims included three Department of Energy labs and health agencies such as the National Institutes of Health and the Department of Health and Human Services, as well as a U.S. security device maker.

The affidavit also ties the group’s services to buyers inside China’s state system. That linkage matters for accountability and a policy response that fits the scale of the threat.

The tools, the targets, and the alleged pipeline

A Defense Department advisory details how QTFY’s tools worked. QScan and QTRouter hid attacker locations and helped probe and route traffic into victim networks.

The advisory attributes QTFY to a Nanjing-based company established in 2018 and lists targets across defense, communications, government, and higher education.

It highlights scans against a U.S. state government, a U.S. water district, the U.S. Senate, a hospital system, and even a U.S. election system. That pattern shows method, not chaos.

Federal reporting adds reach beyond Washington. The affidavit cited by reporters lists Energy, Health and Human Services, and the National Institutes of Health among the victims, as well as U.S. and South Korean companies.

The breadth matches what security pros expect from modern state-aligned hacking: go wide to find the weak link, then pivot. That is how you land near sensitive data and controls. It is also how you test response speed and where the lights flicker first.

China’s denial, and how to weigh it

China’s embassy in Washington rejected the claims and said China opposes all cyberattacks, urging the United States to stop using cybersecurity issues to smear China.

That response mirrors past statements in other cases, where the embassy called similar allegations “baseless slanders and accusations”. The denial deserves space in the record.

The public evidence, however, includes a Defense advisory, a Justice Department action, and court filings tied to seizures—signals that U.S. agencies feel confident enough to name names.

🔴 U.S. Says Chinese State-Sponsored Hackers Targeted NASA, Federal Reserve, DOJ and Senate

📍WASHINGTON — August 26, 2026 | HewadPress

The U.S. Justice Department and FBI announced Wednesday that they have dismantled two hacking platforms allegedly operated by a Chinese… pic.twitter.com/ktsFL3IYXG

— HewadPress (@HewadPress) August 26, 2026

The government did more than tweet; it seized infrastructure and published details. That combination carries weight. If later facts add nuance, they should shape penalties rather than erase the need to shore up our networks today.

What comes next for security, policy, and you

The playbook from 2014 onward is clear. Public attribution pairs with actions: seizures, advisories, and indictments to raise costs and warn defenders. The United States has used that model across cases tied to China, Iran, Russia, and North Korea.

Expect more pressure on vendors to harden remote support tools, more hunt-forward operations with allies, and tighter rules for critical infrastructure. Expect state and local networks to get special attention, because the blast radius runs through them.

Readers do not run NASA, but they do rely on hospitals, banks, and utilities on the target list. Ask providers how they segment networks and patch exposed systems. Support policies that back up talking points with funding and clear standards.

Demand transparency about what was hit and what changed. Cyber defense is not a spectator sport. When attackers test the locks on the Senate and an election system in the same season, it is time to install deadbolts, not new doorbells.