US Cracks Down on Chinese State Hackers Using IoT Devices as Global Attack Camouflage Network

The U.S. Justice Department and FBI have seized a hacking platform used by Chinese state-sponsored hackers.

On August 26, 2026, the U.S. Department of Justice announced that it had obtained court authorization to seize domains associated with two complementary hacking platforms known as QScan and QTRouter. According to the department, the platforms had been used to target U.S. critical infrastructure and other sensitive networks.

On the surface, this is a domain-seizure case.

But the substance is larger. The operation reveals that Chinese state-sponsored hackers were not simply distributing malware. They were allegedly operating cyber-operations infrastructure that connected compromised IoT devices, commercial proxies and rented virtual private servers to hide the origin of attacks.

According to the Justice Department, the organization behind these platforms is a Chinese state-sponsored group known as QTFY. Court documents identify the group as associated with Nanjing Xinjiuwei Network Technology Company, a Nanjing-based company alleged to have provided hacking services to paying customers, including China’s Ministry of State Security and the People’s Liberation Army.

The targets reportedly included NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate.

The key to the case is the role of QScan and QTRouter.

QScan was described in court documents as a vulnerability scanning and exploitation platform capable of finding and infecting internet-connected devices. Those compromised devices could then be folded into QTRouter, an obfuscation network that combined infected IoT devices, commercial proxy services and rented VPS infrastructure.

In other words, QScan created infections, and QTRouter turned those infected devices into a concealment network.

That structure matters deeply in cyber operations. If an attacker directly targets a U.S. agency from infrastructure in China, traces of that origin are easier to track and block. But if the traffic passes through compromised IoT devices, third-country proxies or devices located near the target organization, the attack may appear to come from an ordinary device in another region rather than from China.

The attacker uses someone else’s device as a pathway to hide malicious activity.

That is what QTRouter represents. It is not just a botnet. It is an operational camouflage network designed to conceal the source of attacks.

The Justice Department said the seized domains were hard-coded into both QScan and QTRouter malware and used for essential functions such as communication and authentication. As a result, the court-authorized seizures made both platforms inoperable.

In cyber operations, a domain is not just an address. It can be the connection point through which malware communicates with command-and-control infrastructure, authenticates infected devices and receives instructions. If malware depends on that domain, taking control of it is like cutting the nervous system of the attacker’s infrastructure.

That is why this operation can be understood as offensive law enforcement.

In the past, cyber investigations often focused on identifying and indicting attackers. But state-sponsored hackers and overseas-based organizations are difficult to arrest. Their infrastructure is distributed across multiple countries, and the actual operators may be beyond the easy reach of law enforcement.

So in recent years, the United States has repeatedly used a different approach: directly disrupting attacker infrastructure.

In 2023, the FBI disrupted a botnet used by the China-sponsored hacking group Volt Typhoon to conceal intrusions into U.S. and overseas critical infrastructure. In 2024, the FBI disabled a botnet made of hundreds of thousands of infected IoT devices that the China-sponsored group Flax Typhoon was providing to Chinese government customers. In 2025, the FBI removed PlugX surveillance malware from more than 4,000 U.S. computers infected by the PRC-sponsored group Mustang Panda. The QScan and QTRouter seizure sits on the same line of action.

The message is clear.

The United States will not only defend against Chinese hacking operations.

It will identify infected infrastructure, seize domains, disrupt botnets and raise the cost of attack.

This approach shows a shift in cyber-security strategy.

Cyber defense no longer happens only inside victim organizations. The intermediate infrastructure used by attackers, command-and-control domains, proxy networks, compromised IoT devices and even commercial services can become targets of law enforcement and technical operations. The core objective is to reduce the space in which attackers can hide.

IoT devices are repeatedly being used in state-sponsored hacking operations.

Home routers, CCTV systems, network-attached storage devices, small servers and neglected internet-connected equipment are often slow to receive security updates, and administrators may not know their status. Once infected, they can remain undetected for a long time. Attackers can take control of these devices at scale to route traffic and obscure the true source of operations.

In the past, IoT botnets were mostly associated with distributed denial-of-service attacks. Now they are used for more sophisticated purposes. State-sponsored hackers use compromised IoT devices to hide reconnaissance, intrusion, credential theft, lateral movement and data-exfiltration attempts. If attack traffic appears to come from normal home devices or commercial proxies near the victim organization, detection becomes much harder.

This creates a heavy burden for critical-infrastructure defenders.

If attackers are not connecting from Chinese IP addresses, simple geography-based blocking will not work. If attackers route operations through compromised devices around the world, defenders must rely more on behavior-based detection, authentication anomalies, session patterns and long-term log analysis. Threat intelligence and law-enforcement disruption of infrastructure must work together.

The targets mentioned in the case are symbolic.

NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate are all connected to core national functions. Space, finance, energy, justice, health, research and legislative institutions are all involved. This shows that Chinese-linked cyber operations are not limited to military secrets.

State-sponsored cyber operations do not target only military intelligence.

Policy decision-making information.

Technical research data.

Health and biotechnology information.

Financial-system information.

Energy-infrastructure information.

Internal communications of Congress and government agencies.

All of these can have strategic value.

The Justice Department’s description of QTFY as providing hacking services to customers including the Ministry of State Security and the People’s Liberation Army also points to another shift. State-sponsored cyber activity does not always occur only inside government agencies. Private or quasi-private technology companies may provide hacking services, while state agencies use them.

This is a hybrid state-private cyber ecosystem.

Government agencies provide demand and objectives. Private technology organizations provide tools, infrastructure and operational capability. This structure makes it easier for the state to deny direct responsibility while increasing technical development and operational scalability. Attackers move like companies, provide services to customers and operate platforms that can be reused across multiple campaigns.

In that sense, QScan and QTRouter are closer to hacking infrastructure as a service than to ordinary malware.

QScan finds and expands infection targets.

QTRouter combines compromised devices and proxies into a concealment network.

Customers use that infrastructure to hide the origin of intrusion activity.

Attack infrastructure is becoming platformized.

This changes how defenders must think. It is not enough to analyze individual attack campaigns. Defenders must track the infrastructure repeatedly used behind them: domains, authentication systems, proxy networks, methods for recruiting infected devices and the organizations operating them. The goal is not only to resolve one intrusion incident, but to break the foundation attackers can reuse for the next operation.

That is why the Justice Department and FBI seized the domains.

Domain seizure is not merely incident response for one victim organization. It is an action that shakes the attack platform itself. If essential domains hard-coded into malware are taken over, attackers may lose the ability to communicate with infected networks or perform authentication. Even if some compromised devices remain, the command structure can be disrupted.

Of course, this does not mean the operation is permanently over.

Attackers can create new domains, build new infrastructure and modify malware. Parts of a botnet may survive. But infrastructure seizure imposes cost. It interrupts operations, consumes time, forces network reconstruction and gives investigators and security researchers more indicators to track.

That is the context behind the FBI’s emphasis on shaping adversary behavior.

The goal of cyber law enforcement is not merely to stop one attack. It is to force attackers to bear more cost and risk, reduce their operational persistence and allow defenders to regain some initiative.

The announcement also shows the importance of private threat intelligence.

The Justice Department said the FBI and NSA issued a joint cybersecurity advisory containing indicators of compromise associated with QTFY’s malicious cyber activity. It also pointed to analysis by Lumen Technologies’ Black Lotus Labs on QTFY’s tactics, techniques and procedures.

This structure is characteristic of modern cyber defense.

Governments have law-enforcement authority and national-security intelligence.

Private security companies have global network visibility and traffic-analysis capabilities.

Victim organizations have real traces of compromise.

Telecommunications and cloud companies have infrastructure-level visibility.

All four must work together to disrupt the infrastructure of state-sponsored hackers.

The implications for Korea are significant.

Korean government agencies, defense contractors, energy companies, telecommunications providers, financial institutions, medical organizations and research institutes can also become targets of state-sponsored hacking. Korea is deeply connected to the United States through security, technology, semiconductors, batteries, AI and defense supply chains. Chinese, North Korean and Russian cyber operations can all view Korean networks as targets, reconnaissance spaces or transit routes.

The important lesson from this case is that the visible origin of attack traffic may not match the actual sponsor.

If traffic appears to come from a home router in Korea, an overseas cloud server or a commercial proxy, one cannot simply assume it is the work of an ordinary criminal group. State-sponsored hackers already use global IoT devices and proxy networks to hide origin. Defenders must therefore look beyond IP nationality and focus on behavior patterns and infrastructure relationships.

Public agencies and companies should pay particular attention to three areas.

First, internet-exposed IoT and network-device management. Routers, VPN equipment, NAS devices, CCTV systems, remote-management devices and small servers can become favored footholds for state-sponsored hackers. Old firmware, default passwords and unnecessary remote-access ports should be removed first.

Second, behavior-based detection of proxy, VPN and cloud-routed traffic. Simple foreign-IP blocking is not enough. Organizations must monitor abnormal login attempts, access at unusual times, device-fingerprint changes, session movement, API-call patterns and privilege-escalation attempts together.

Third, operational use of threat intelligence and indicators of compromise. Indicators published by the FBI, NSA or private security companies should not remain as reference material. They should be reflected in firewalls, EDR systems, SIEM rules, cloud logs, DNS logs and proxy logs. Organizations should turn them into detection rules and search historical logs retroactively.

One of the most dangerous illusions in cybersecurity is the belief that “we are not a direct target.”

State-sponsored hackers do not attack only their direct targets. They also use transit points, infected networks, concealment infrastructure, supply chains, partners and research organizations to reach those targets. A small IoT device can become part of an international cyber operation.

The QScan and QTRouter case shows this reality again.

A hacking platform is no longer just a piece of attack code. It recruits compromised devices, disguises traffic, provides hidden routes to customers and becomes reusable infrastructure for state-sponsored operations. Cyberwar is a war of code, but it is also a war of infrastructure.

The U.S. response is changing accordingly.

Block.

Seize.

Remove.

Publish indicators.

Work with the private security industry to expose attacker infrastructure.

This is a model in which defenders do not passively wait for compromise, but directly target the operational base of attackers.

But the responsibility for defense does not rest only with governments.

Many infected IoT devices may belong to companies, individuals, schools, research institutions or small businesses. If these devices are neglected, their owners become victims and, at the same time, provide a foothold for attacks against other institutions. Cybersecurity has become not only a matter of protecting one’s own organization, but a matter of ecosystem responsibility.

One unpatched router.

One neglected CCTV camera.

One device with a default password.

One abandoned remote-access account.

Such small openings can become bypass routes for state-sponsored hackers.

The message of this case is clear.

Chinese state-sponsored hackers no longer only conduct direct intrusions. They infect devices scattered around the world, connect them into platforms that hide attack origins and use those platforms to target U.S. critical infrastructure and sensitive government networks.

The standard for cyber defense must also change.

The important question is not only whether our systems have been directly breached. We must also ask whether our devices are being used as someone else’s attack infrastructure. Attackers always look for the weakest path, and that path may begin not in a core system, but in neglected peripheral equipment.

Protecting critical infrastructure no longer happens only inside data centers.

It begins with the security of small devices scattered around the world.