The FBI has seized a series of domains used by the China-linked QTFY botnet, disrupting infrastructure that U.S. prosecutors say supported cyberattacks against hospitals, defense contractors, federal agencies, and other American targets. The Justice Department said the seizures made the botnet’s command-and-control infrastructure inoperable because the domains were hardcoded into its software.
According to the Justice Department’s official announcement, QTFY was operated by Chinese company Nanjing Xinjiuwei Network Tech. Prosecutors allege the company maintained a network of thousands of compromised internet-connected devices that customers could use to disguise malicious traffic.
Botnet Allegedly Supported Chinese Government Hackers
The Justice Department said QTFY offered hacking services to customers that included Chinese government hackers working for the Ministry of State Security. The compromised devices were used as obfuscation infrastructure, helping attackers conceal the origins of their traffic and making malicious activity harder to trace.
The attacks date back to at least 2018 and affected systems belonging to NASA, the Federal Reserve, and the Departments of Energy, Justice, and Health and Human Services. An FBI affidavit filed in support of the seizures also alleges that the U.S. Senate was compromised as recently as 2026.
Because the seized domains were built directly into the botnet’s code, removing access to them disrupted communications between infected devices and the command-and-control servers used to manage the network.
Lumen Shared Threat Intelligence With the FBI
Network provider Lumen said it had been tracking the infrastructure for about a year and had observed activity targeting government agencies, defense and aerospace organizations, and other sectors.
In its technical analysis, Lumen said it shared threat intelligence with the FBI as investigators worked to identify and disrupt the network.
The Justice Department said the operation removed access to the platforms used by QTFY operators and their customers, preventing them from continuing to rely on the seized domains for the botnet’s essential communications.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.