U.S. Agencies Ghosted Through Home Routers

The Justice Department says it knocked offline two Chinese-run hacking platforms that, for years, helped break into sensitive U.S. government systems.

Story Snapshot

Justice Department and Federal Bureau of Investigation seized domains tied to QScan and QTRouter.
Court papers link the tools to a China state-backed group working through a private firm.
Victims named include the Federal Reserve, National Aeronautics and Space Administration, the Senate, and health agencies.
China’s embassy rejects the claims and calls them political smears.

What U.S. Officials Say They Shut Down

On August 26, the Justice Department said court orders let agents seize domains that powered two tools called QScan and QTRouter. Prosecutors said QScan infected many internet‑connected devices and fed them into QTRouter. QTRouter then hid the true origin of hack traffic by bouncing it through those compromised machines. Officials said the seized domains were hard‑coded into the malware, so the takedown made both tools stop working. The Federal Bureau of Investigation led the technical action.

Court documents unsealed in San Diego describe a state‑sponsored group, called QTFY, that allegedly built and ran the platforms. The papers say a China‑based company, Nanjing Xinjiuwei Network Technology, employed the group. Reuters reported the Justice Department said this company’s clients included China’s Ministry of State Security and the People’s Liberation Army. The filings portray the setup as “hacking as a service,” sold to state organs rather than a one‑off malware drop.

Targets and Timeframe Identified in Filings

Reuters reported that the affidavit lists the Department of Energy, the Department of Health and Human Services, and the National Institutes of Health among victims, along with four unnamed firms in the United States and South Korea. Other reporting on the Justice Department statements cites the Federal Reserve, the National Aeronautics and Space Administration, the Senate, and the Justice Department itself as in scope for intrusions or attempts. Separate summaries say the operation ran at least from 2018 through 2026, suggesting a long campaign.

The government’s description raises stakes for both parties and households. When attackers hide inside home routers or smart devices, they can mask attacks on banks, hospitals, or agencies. That puts regular people in the blast radius. The Justice Department says the obfuscation network made traffic look like it came from outside China. That creates headaches for defenders, and room for confusion about who did what. It also shows why basic device hygiene matters at home.

China’s Denial and the Evidence Gap

China’s embassy in Washington denies the charges and says the United States is smearing China with “unfounded” claims. Embassy statements in other cases make similar points, saying China opposes all hacking and rejects politicizing cybersecurity. Here, the public record relies on government releases and media summaries. The full affidavit text, technical logs, and malware samples are not visible to the public in these reports, which limits outside review of the attribution chain.

The Fed Was Hit, But That Is Not the Real Story
The US Says China Built Hacking Infrastructure as a Service

————–
The viral version is simple:
“Chinese hackers broke into the Federal Reserve.”

That is directionally based on a real US government action, but it… https://t.co/PNxFQSzc8T pic.twitter.com/G4L08uEtEl

— PetrAnto (@petranto) August 27, 2026

That evidence gap is common in cyber cases. Experts argue governments should show enough proof for independent checks when they make severe claims. At the same time, long delays for full disclosure can leave citizens stuck between fear and doubt. People across the political spectrum see a pattern: agencies sound alarms, but the public seldom sees the raw data. That fuels concern that elites guard secrets while everyday users and small businesses carry the risk.

Why This Matters Beyond Partisan Lines

For conservatives, the case touches national security, supply chains, and the price of weak borders in cyberspace. For liberals, it highlights how tech systems fail the public and widen the gap between the powerful and everyone else. For both, it underscores a bigger worry: a government that cannot secure its own networks may not be safeguarding yours. If tools like QScan and QTRouter ran for years, then agencies missed warning signs or lacked resources to act sooner.

Practical steps can help while Washington argues. Update home routers and smart devices. Turn on automatic updates on phones and computers. Change default passwords. Use multifactor sign‑in on bank, health, and email accounts. Companies should check firewall logs for strange outbound traffic and review vendor access. These basics will not stop a nation‑state on their own, but they shrink the attack surface criminals and foreign services use every day.

What to Watch Next

Watch for the Justice Department to release indicators of compromise that private defenders can use to hunt for infections. Look for statements from named agencies, such as the Federal Reserve or the National Aeronautics and Space Administration, confirming scope and impact. Congress may press the Federal Bureau of Investigation and prosecutors to explain the attribution chain in more detail. Clearer facts would help citizens judge the claims and would set a stronger bar for future cases.