The Justice Department and FBI said on Aug. 26 that intrusion attempts had targeted NASA, the Federal Reserve, the Justice Department and the U.S. Senate since 2018, along with the Department of Energy, Department of Health and Human Services and the National Institutes of Health. Four unnamed companies in the United States and South Korea were also reportedly targeted. The machinery of state security is busy again, this time chasing a China-linked operation that federal officials say used tools called QScan and QTRouter to scan for vulnerable systems, infect thousands of internet-of-things devices and hide the origin of attacks.
Who Has the Power
According to the Justice Department, a Chinese state-sponsored group known as QTFY created and operated QScan and QTRouter. Federal officials said the group worked for the China-based Nanjing Xinjiuwei Network Technology Company, which the Justice Department alleges offered hacking services to paying customers, including China's Ministry of State Security and People's Liberation Army. That’s the hierarchy in plain sight: state agencies, private contractors and military clients moving through the same digital back channels while ordinary people get the fallout.
Court documents also described targets that included hospitals, telecommunications providers, financial institutions and defense contractors. Authorities said QTFY infrastructure has been used to compromise critical infrastructure and other sensitive networks since at least 2018. The people who rely on those systems don’t get a vote in any of this. They just live with the consequences when the networks fail, get watched, or get turned into battlegrounds for rival power blocs.
FBI Director Kash Patel said, "These tools were used by PRC cyber actors to hide the origin of their attacks." The Justice Department obtained court authorization to seize domains used by QScan and QTRouter, and federal officials said the domains were hard-coded into the malware and used for essential functions, including communication and authentication. Once authorities seized them, the Justice Department said QScan and QTRouter became inoperable. The state calls that disruption. The rest of us can call it another reminder that the digital world runs on infrastructure controlled from above, then defended with more control from above.
Who Gets Crushed
NASA spokesperson Jennifer Dooren said, "NASA is committed to the cybersecurity and the protection of our systems," and added, "We work closely with our federal partners, including the Cybersecurity and Infrastructure Security Agency, to quickly address identified vulnerabilities. We continuously collaborate with software partners and actively monitor and assess our networks, software and data for potential risks." She also said, "For security reasons, NASA does not comment on specific reports of potential vulnerabilities or incidents. For additional information regarding this matter, please contact the Department of Justice."
That’s the familiar loop: public institutions, federal partners and software vendors all locked together, all speaking the language of protection while keeping the public at arm’s length. The people whose data, services and work depend on these systems are left with managed statements and closed doors.
An embassy spokesperson at the Chinese Embassy in Washington said, "I am not aware of the specifics you mentioned," and added, "China is a firm defender of cybersecurity. The Chinese government firmly opposes and combats all forms of cyberattacks in accordance with the law. We urge the U.S. side to stop using cybersecurity issues to smear or discredit China." The spokesperson also said, "China firmly opposes the U.S. overstretching the concept of national security and using it as a pretext to impose discriminatory restrictions on Chinese companies and will firmly safeguard the legitimate rights and interests of Chinese companies." After being sent the specific Justice Department release, the embassy said it had "no further information to add at the moment."
Black Lotus Labs said in a statement that "taking down a single quartermaster's obfuscation network systematically degrades the capabilities of multiple active threat campaigns at once." The researchers said they shared threat intelligence with U.S. government agencies about emerging risks and null-routed traffic to known infrastructure used by the operators. They described the operation as a kind of cyber "quartermaster," providing shared reconnaissance, routing and concealment infrastructure that multiple China-linked threat actors could use. Even the language of the cleanup sounds like logistics for a war economy.
What They're Calling Security
The latest operation followed previous federal efforts targeting Chinese hacking groups. In 2025, the FBI removed PlugX surveillance malware from more than 4,000 U.S. computers infected by the China-sponsored Mustang Panda group. In 2024, federal agents disabled a botnet made up of hundreds of thousands of infected IoT devices associated with Flax Typhoon. The FBI previously disrupted another botnet used by Volt Typhoon to conceal attacks targeting U.S. and foreign critical infrastructure. Fox News has also reported on Salt Typhoon, the China-linked hacking campaign that penetrated major American telecommunications networks.
In a separate Fox News report, the social media platform X said it had uncovered a massive suspected Chinese bot farm conducting "influence operations" online in the United States, including pushing an anti-artificial intelligence and anti-data center narrative. X's Global Government Affairs account said the platform's safety team identified a bot farm of approximately 200,000 inauthentic Chinese accounts "involved in influence operations." The X team said that within the bot farm, 200 accounts were found posting "in a manner that could manipulate a legitimate debate about American AI and energy policy."
According to X, posts by these accounts contained claims that AI data centers are driving up household electricity prices and straining the grid. The platform said other accounts also posted AI-generated cartoons depicting data center developers enriching themselves at the public's expense. One image shared by the team depicted citizens across from data center developers with bags of cash and the caption, "Data centers get subsidized while we foot the bill!" Another image read that "the AI industry is booming, but the costs are being borne by ordinary people."
X said the influence campaign came as debate raged over the costs and benefits of continuing to develop artificial intelligence at breakneck speed and the massive data centers required to power it. The platform said the debate also had political implications, dividing parties internally as many members of the GOP broke with President Donald Trump on AI and data centers. X said it remained "committed to maintaining an open and authentic platform where people debate topics of public interest" and that it takes seriously any attempts to undermine the integrity of the global town square.
The platform said it had suspended accounts that violated its Authenticity policy. It also noted that OpenAI had earlier banned a "cluster of ChatGPT accounts that likely originated in China" that were being used to generate a "covert influence operation" primarily targeting U.S. audiences. OpenAI said those accounts generated short comments and images similarly claiming that data centers and AI were increasing electricity demand and causing higher costs.
President Donald Trump said at the White House earlier this week that the AI industry needs "a little public relations help," pointing to a May Gallup poll showing a majority of Americans oppose data centers being built in their communities. Trump said local communities and states should want to welcome data centers because "the jobs are enormous, and the money paid, the taxes paid are just enormous." He added, "And if you don't take it, you're going to be left behind because there are plenty of places that want it."
Sen. John Fetterman, D-Pa., wrote that "AI supremacy and energy dominance underpins our national security" and warned that China benefits from "overreaction" to "AI doomsdaying" in the U.S. as the two countries compete for dominance in the industry. The argument keeps circling back to the same place: states, corporations and platforms fighting over control of the network, while everyone else is told to accept the bill, the risk and the propaganda.