The US just seized the servers behind China's hacking-for-hire empire

Key points

• The US Justice Department and FBI seized internet domains belonging to Nanjing Xinjiuwei Network Technology, a Chinese hacking-services company, in an operation announced last week.
• QScan infected thousands of everyday devices worldwide; QTRouter wove those hijacked devices into a relay network spanning more than 130 countries.
• Confirmed targets include NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the US Senate.
• Nanjing Xinjiuwei's paying clients included China's Ministry of State Security and People's Liberation Army units.
• Analysts expect similar contractor companies to replace it, possibly including Nanjing Xinjiuwei itself.

A private company in Nanjing, China built a subscription service for state-sponsored hackers. Last week, the FBI and Department of Justice seized its domains.

The company, Nanjing Xinjiuwei Network Technology, operated under a hacking group researchers tracked as QTFY. It sold two tools. QScan automatically found and silently infected thousands of internet-of-things (IoT) devices worldwide, things like home routers and security cameras, without their owners knowing. QTRouter then wove those hijacked devices into a private relay network, meaning traffic from Chinese state hackers appeared to originate from ordinary homes and businesses worldwide rather than from China itself.

"Instead of appearing to come from China, traffic is routed through everyday devices in more than 130 countries, potentially through systems just down the street from the victim's own network," FBI cyber assistant director Brett Leatherman said.

We reported on this operation when the seizure was first announced on 26 August, including Lumen's Black Lotus Labs' role in mapping the infrastructure over the preceding year.

What did the hackers actually do with this?

For nearly a decade, QTFY gave paying clients a ready-made attack pipeline. Clients could scan for targets, break in, and cover their tracks through shared infrastructure they did not have to build themselves.

Targets identified by the FBI included NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the US Senate. Power companies, telecoms, and hospital systems were also hit.

Lumen's Black Lotus Labs described the company's role as that of a "quartermaster", a military supply term for someone who equips the troops. Nanjing Xinjiuwei did not always conduct the break-ins itself; it sold the tools and the hiding infrastructure so that multiple separate hacking teams could run their own operations through one shared network.

"It's kind of like a choke point," said Dakota Cary, a China-focused analyst at SentinelOne, speaking to CSO Online. "You have a bunch of teams using the same network to carry out offensive operations. If you take down that network, they all have to go find new infrastructure."

Why does China use private companies for this?

Beijing gets deniability and scale from outsourcing. Private contractors, often founded by people who left the People's Liberation Army, do the work at arm's length from the government.

"It gives the government plausible deniability because it's not actually coming from their units," said Damon Rouse, senior security engineer at Black Lotus Labs. The FBI tracked payments from PLA and Ministry of State Security units directly to Nanjing Xinjiuwei, exposing the client list.

This isn't the first time US law enforcement has dismantled Chinese hacking infrastructure. In 2024 the FBI disabled a botnet run by Flax Typhoon (Microsoft's label for the group). The year before, it disrupted a separate botnet tied to Volt Typhoon (also Microsoft's label), which had hidden inside US critical infrastructure. Mustang Panda (tracked by multiple vendors including CrowdStrike) had surveillance software removed from more than 4,000 US computers in a distinct action.

Should ordinary people be worried?

Government agencies and large organisations were the primary targets, not individual consumers. But attack traffic passed through ordinary home routers and IoT gadgets.

Keeping device firmware up to date is the single most useful step a household can take. Replacing old devices that no longer receive updates is worth considering too.

Geography-based blocking, tools that flag traffic because it originates from a suspicious country, no longer works reliably against this kind of operation. Chinese state hacking traffic looked like it came from Charter Communications addresses inside the United States. Organisations need tools that watch for unusual behaviour, not just unusual origins.

Analysts are clear-eyed about what the seizure does and doesn't achieve. "It would be naive to say there's not going to be another company or another 10 companies doing something very similar," Rouse said. Chinese cybersecurity firm Chengdu 404, indicted years ago as a front for the group tracked as APT41, still operates from the same address. Nanjing Xinjiuwei could do the same. The disruption forces a scramble. It doesn't end the game.

The honest read here is that this takedown matters most as intelligence, not as a kill shot. The FBI's payment mapping exposed a supply chain that Beijing would rather keep invisible. That's valuable. But the underlying contractor ecosystem is structural, not accidental, and a single seizure won't unwind years of deliberate market-building.