U.S. seizes QScan and QTRouter domains tied to China-linked hacking platform
The U.S. Justice Department and FBI seized domains used by QScan and QTRouter, platforms investigators linked to the Chinese group QTFY. Authorities said the infrastructure targeted NASA, the Federal Reserve and critical infrastructure since 2018.
By DoomRadar · Published on DoomRadar . Updated .
Places in the report
- United States[1]
Countries named in the cited reporting. Highlighting does not show the area affected. Map: Natural Earth.
How the effects could reach youConditional effects
Based on one source with available article excerpts. Source-linked claims are not independent confirmation.
What happened
The Justice Department and FBI announced court-authorized seizures of domains used by QScan and QTRouter, two cyber platforms investigators linked to the Chinese group QTFY. The announcement involved the U.S. Attorney’s Office for the Southern District of California and the FBI’s San Diego field office. [1]
References for this detail (1)
- Feds in San Diego seize domains to block China from hackingfoxrochester.com · Article published: Aug 31, 2026, 11:45 PM UTC
Authorities said the campaign had operated since 2018 and targeted high-profile U.S. government entities and critical infrastructure. NASA and the Federal Reserve were among the targets identified in the reporting. [1]
References for this detail (1)
- Feds in San Diego seize domains to block China from hackingfoxrochester.com · Article published: Aug 31, 2026, 11:45 PM UTC
Investigators said QTFY worked through Nanjing Xinjiuwei Network Technology Co. to provide hacking services to Chinese intelligence and military arms. That characterization is attributed to the authorities and court filings described in the report. [1]
References for this detail (1)
- Feds in San Diego seize domains to block China from hackingfoxrochester.com · Article published: Aug 31, 2026, 11:45 PM UTC
According to court filings, the platforms infected thousands of devices worldwide to create an obfuscation network. Such a network masks the apparent origin of attacks by routing activity through compromised devices. [1]
References for this detail (1)
- Feds in San Diego seize domains to block China from hackingfoxrochester.com · Article published: Aug 31, 2026, 11:45 PM UTC
Federal agents reportedly neutralized both tools by seizing hard-coded domains required for the malware to communicate. The sources describe an infrastructure disruption, but do not establish the full extent of earlier compromise or whether every infected device was remediated. [1]
References for this detail (1)
- Feds in San Diego seize domains to block China from hackingfoxrochester.com · Article published: Aug 31, 2026, 11:45 PM UTC
Context from the sources
The operation was carried out in San Diego, while the reported device network and targets extended beyond California and included devices worldwide. [1]
Explore the sources and reporting timeline
1 source links · 1 domains
These counts describe the references, not independent confirmations. Different outlets can repeat the same original report.
Source timeline
Oldest to newest among the available source dates, not a chronology of the incident. Article publication dates come from the source; other recorded dates may reflect when a link was found.
Questions answered by the reporting
What did the domain seizures disrupt?
Court filings said the seized domains were essential to the malware’s communications, and agents reportedly neutralized the tools by taking control of them. [1]
What this could mean for you
Organizations previously targeted by the platforms could face continuing investigation or follow-on activity.
Seizing communication domains disrupts identified malware infrastructure but does not establish that compromised devices have been cleaned or that operators lack replacement infrastructure.
Reported basis: [1] · The possible effect is interpretation.
Depends on: Devices remain infected or the operators rebuild their command-and-control network.
Critical infrastructure operators may face exposure to related China-linked intrusion campaigns.
The reported campaign targeted government and infrastructure entities and used thousands of devices to obscure attack origins.
Reported basis: [1] · The possible effect is interpretation.
Depends on: Related operators retain access to compromised devices or deploy substitute tools.
Possible consequences, not a forecast. Their relevance depends on your location and the conditions above.
For your country
Choose a country to check how this event could affect you.
What changes the outlook
Risk increases if…
Discovery that compromised devices remain active after the domain seizures.
Evidence that QTFY or associated operators have moved to replacement infrastructure.
Pressure eases if…
Successful remediation of infected devices and closure of related access paths.
Confirmation that the seized domains disrupted the operators’ ability to control the identified platforms.
Still unclear
The sources do not quantify the number of affected U.S. organizations or confirmed data losses.
It is not established whether QTFY replaced the seized domains or shifted to other infrastructure.
Market implications
Market impact
Sources (1)
References for the reported details. Separate links do not necessarily mean independent confirmation.
Available excerpt
SAN DIEGO (TCS) — Federal law enforcement has seized core infrastructure reportedly used by a Chinese state-sponsored cyber platform to target high-profile U.S. government entities…A short excerpt from our source record; open the original for the full article.
First tracked by DoomRadar: . AI-assisted analysis · . Based on linked headlines and available excerpts. Methodology · Report an error.