Chinese hacking operations target critical U.S. infrastructure before the Department of Justice blocks the cyber infiltration. Bret Baier and the 'Special Report' All-Star Panel analyze the national security threat, along with President Donald Trump's 97% endorsement success rate in recent Republican primaries.

Chinese state-linked hackers stole sensitive data from more than 300 organizations, including U.S. defense contractors, financial institutions and universities, and breached three Energy Department laboratories, the NIH and an HHS agency before the FBI knocked their hacking platforms offline this week, newly unsealed court records show.

The group, known as QTFY, operated through a China-based company that the FBI says sold hacking services to clients including China’s Ministry of State Security and People’s Liberation Army. Former PLA members worked for the company and used military relationships to secure contracts and subcontracts for offensive cyber operations, according to an FBI affidavit.

QTFY paired mass internet scanning with a network of compromised routers, cameras and other internet-connected devices that helped disguise the origin of its attacks.

FBI SAYS RUSSIAN HACKERS HIJACKED OLD WI-FI ROUTERS

The National Aeronautics and Space Administration (NASA) Headquarters is seen in Washington D.C., United States on September 15, 2023. (Celal Gunes/Anadolu Agency via Getty Images)

By routing malicious traffic through devices near a victim’s network, the hackers could make attacks blend in with legitimate local traffic and become harder to trace, federal officials said.

The Justice Department and FBI seized three domains Wednesday that powered QTFY’s two main platforms: QScan, which hunted for vulnerable systems, and QTRouter, which masked hackers’ identities by routing their traffic through compromised devices.

Federal authorities said the seizures crippled both platforms by cutting off domains used for core communications and authentication.

The scale was massive.

AI IS NOW POWERING CYBERATTACKS, MICROSOFT WARNS

On a single day in 2024, QScan processed more than 2 million scanning and penetration-testing tasks, according to the FBI affidavit. The platform contained more than 200 proof-of-concept exploits and searched the internet for vulnerable software, exposed services and other openings hackers could exploit.

"QTFY is another example of how China’s cyber ecosystem has blurred the line between commercial cybersecurity and state-sponsored operations," Aaron Shraberg, senior intelligence team lead at Flashpoint, told Fox News Digital. "The commercialization of that ecosystem has helped turn capabilities that once relied on bespoke tradecraft into tools and services that can be developed, reused and deployed at scale."

Federal authorities said QTFY targeted NASA, the Justice Department, the Federal Reserve and Senate systems, along with power companies, hospitals, telecommunications providers, defense contractors and election infrastructure.

Fox News Digital has reached out to the Chinese embassy for comment.

Illustration of cybercrime and hacking activity with a laptop displaying a pirate symbol while a hooded person uses a digital tablet in a dark environment in Paris, France, on April 28, 2026. (Hans Lucas/AFP via Getty Images)

But not every attack worked.

In 2019, QTFY tried to break into NASA using a vulnerability in the agency’s virtual private network. The attempt failed because NASA had already patched the flaw, according to the affidavit.

A separate FBI, NSA and Cyber National Mission Force advisory said the group scanned Senate and hospital-system networks in March and a U.S. election system in June but failed to gain access.

Other attacks succeeded.

In May 2024, QTFY exploited a recently disclosed Check Point vulnerability while scanning U.S. power and telecommunications companies and stole data from more than 300 organizations in the United States and abroad, according to the advisory.

The government did not name the affected organizations or describe what information was taken. The advisory said victims included U.S. defense contractors, financial institutions and universities.

Four months later, hackers exploited zero-day flaws in Ivanti Cloud Services Appliance software to gain access to three Department of Energy national laboratories, the National Institutes of Health, the Health Resources and Services Administration and a U.S. security-device manufacturer, the advisory said.

The national flags of China and the United States are seen flying outside a commercial building on March 17, 2026 in Hong Kong, China. (Cheng Xin/Getty Images)

FBI BRINGS ALLEGED CHINA-LINKED HACKER TO US IN RARE EXTRADITION AS PATEL DEFENDS ITALY TRIP

The advisory did not disclose what information was accessed, how long the hackers remained inside the networks or whether the breaches disrupted operations.

"State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted," Attorney General Todd Blanche said in a statement announcing the seizures.

The takedown adds to a string of FBI operations aimed at dismantling infrastructure used by Chinese government-linked hacking groups.

In 2023, the FBI disrupted a botnet used by Volt Typhoon, a China-linked group accused of concealing its access to U.S. and foreign critical infrastructure.

SIGN UP TO GET THE POLITICS NEWSLETTER

The following year, the bureau disabled a botnet made up of hundreds of thousands of infected internet-connected devices that federal officials said Flax Typhoon supplied to Chinese government customers.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Last year, the FBI said it removed PlugX surveillance malware from more than 4,000 U.S. computers infected by Mustang Panda, another China-linked hacking group.

Get the latest updates on the Trump administration and Congress, exclusive interviews and more Fox News politics content.

By entering your email and clicking the Subscribe button, you agree to the Fox News 
        Privacy Policy
       and 
        Terms of Use
      , and
      agree to receive content and promotional communications from Fox News. You understand that you can
      opt-out at any time.

Subscribed

You've successfully subscribed to this newsletter!