{
  "id": 3669304,
  "title": "FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks",
  "url": "https://urgent.news/2026/08/27/fbi-seizes-hacking-tools-it-says-china-used-to-attack-nasa-doe-us-3669304",
  "topic": "science",
  "section": "Science",
  "published": "2026-08-27T00:06:03.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/27/fbi-seizes-hacking-tools-it-says-china-used-to-attack-nasa-doe-us-senate-and-other-critical-networks/5292742"
  },
  "original_language": "en",
  "account": "On Wednesday, the FBI announced it had taken action against a sophisticated hacking operation using Chinese-government cyber operatives. They seized two platforms and disrupted a botnet used to target critical networks, including NASA, the US Senate, the Department of Energy, and several other government agencies.\n\nThe hacking tools, QScan and QTRouter, were created and operated by a Chinese-backed group called QTFY, which works for a private Chinese company called Nanjing Xinjiuwei. The FBI believes QTFY's hackers are former members of the People's Liberation Army (PLA) and use their connections to secure contracts supporting offensive cyber operations.\n\nAccording to court documents, QScan scans and infects thousands of IoT devices worldwide, adding them to the QTRouter network. This botnet serves as an obfuscation network, making it difficult to trace the origin of malicious digital activities.\n\nThe hacking services have been in use since at least 2018, and were recently used to target the US Senate in 2024, according to the FBI. QTFY exploited a known vulnerability in Ivanti's Pulse Secure VPN in 2019, 2020, and 2024, as well as a flaw in Citrix VPN products. Most recently, QTFY hackers breached computers at three DOE National Laboratories, NIH, and a US security device manufacturer in 2024.\n\nThis enforcement action is part of a series of court-ordered seizures aimed at disrupting China's hacking activities over the past few years. The FBI has taken down other Chinese-sponsored malware and botnets, including those used by Mustang Panda, Flax Typhoon, and Volt Typhoon.",
  "summary": "Beijing's botnets busted.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 6,
    "also_reported_by": [
      {
        "outlet": "Hindustan Times - World News",
        "title": "Chinese hackers broke into US Justice Department, NASA, Senate and more, say officials",
        "url": "https://urgent.news/2026/08/26/chinese-hackers-broke-into-us-justice-department-nasa-senate-and-more",
        "published": "2026-08-26T16:47:47.000Z"
      },
      {
        "outlet": "TechCrunch",
        "title": "US seizes domains of Chinese botnet used to hack NASA, Justice Department, and the Senate",
        "url": "https://urgent.news/2026/08/26/us-seizes-domains-of-chinese-botnet-used-to-hack-nasa-justice",
        "published": "2026-08-26T17:01:05.000Z"
      },
      {
        "outlet": "Al Jazeera",
        "title": "US says Chinese-linked hackers attacked NASA, Senate, and gov’t agencies",
        "url": "https://urgent.news/2026/08/26/us-says-chinese-linked-hackers-attacked-nasa-senate-and-govt-agencies",
        "published": "2026-08-26T20:59:10.000Z"
      },
      {
        "outlet": "Semafor",
        "title": "US blames Chinese company for NASA, DOJ hacks",
        "url": "https://urgent.news/2026/08/26/us-blames-chinese-company-for-nasa-doj-hacks",
        "published": "2026-08-26T22:24:51.000Z"
      },
      {
        "outlet": "The Register",
        "title": "FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks",
        "url": "https://urgent.news/2026/08/27/fbi-seizes-hacking-tools-it-says-china-used-to-attack-nasa-doe-us",
        "published": "2026-08-27T00:06:03.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}