Story perspectives

DOJ and FBI Seize QTFY Domains, Disrupting Botnet

8/29/2026

Center

Justice Department Seizes

The U.S. Justice Department and FBI seized domains used by the Chinese hacking platform QTFY which targeted several U.S. government agencies.
The botnet was run by Nanjing Xinjiuwei Network Technology, which sold hacking services to Chinese Ministry of State Security actors.
QTFY’s QScan and QTRouter infected IoT devices, creating a proxy network that masks traffic origins.
Seizing the domains cut off the botnet’s hard-coded command-and-control servers, rendering the network inoperable.

Left

DOJ Seizes

The U.S. Department of Justice and FBI seized domains used by the Chinese hacking platform QTFY that had targeted several U.S. government agencies.
The DOJ corrected its statement, stressing the need for accurate public reporting on cyber threats.
Edits were made to align the press release with the affidavit justifying the seizures.
A footnote said NASA’s attempted breach was blocked after the agency patched the vulnerable software.

Blindspot

The botnet behind the QTFY platform was operated by Nanjing Xinjiuwei Network Technology, which offered paid hacking services to actors of China’s Ministry of State Security, according to the Center-leaning sources.
Within this story's sources, this angle appears mainly in Center-leaning coverage and receives less attention in Left-leaning coverage.

History

Historical Context

After the 2009 Operation Aurora breach that exposed Google, Adobe and more than 30 victim organizations to Chinese Ministry of State Security hackers, the U.S. Department of Justice and FBI seized QTFY domains tied to a Nanjing-based botnet selling illicit services. The action echoes the earlier crackdown, underscoring a sustained strategy to dismantle foreign proxy infrastructures and protect agencies such as NASA.

1 of 4

Justice Department Seizes

The U.S. Justice Department and FBI seized domains used by the Chinese hacking platform QTFY which targeted several U.S. government agencies.
The botnet was run by Nanjing Xinjiuwei Network Technology, which sold hacking services to Chinese Ministry of State Security actors.
QTFY’s QScan and QTRouter infected IoT devices, creating a proxy network that masks traffic origins.
Seizing the domains cut off the botnet’s hard-coded command-and-control servers, rendering the network inoperable.

1 / 4