EVENT DOSSIER
On August 26, 2026, the U.S. Department of Justice announced the seizure of a series of domain names used by the Chinese hacking group QTFY to coordinate cyber attacks. This large botnet, operated by the Chinese company Nanjing Xinjiuwei Network Technology, has been infiltrating systems of U.S. hospitals, defense contractors, and various federal departments since 2018. Recent targets of attacks include NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, and the Senate. QTFY sells hacking services to clients including China’s National Security Department and uses this botnet to hide malicious traffic. The seizure of the domain names prevents the command-and-control servers of the botnet from functioning, as these key communication domains are hard-coded into its code. The U.S. Cybersecurity Agency previously announced that although hackers scanned the relevant networks, they failed to gain access.
US Justice Department → Chinese botnet domains 查封用于攻击 NASA 等机构的网络域名
美国司法部周三宣布，已扣押一系列被中国黑客组织 QTFY 用于协调针对美国目标的网络攻击的域名。该由中国公司南京新九维网络技术运营的大型僵尸网络曾于 2018 年起入侵美国医院、国防承包商及多个联邦部门系统，近期甚至袭击了 NASA、美联储、能源部、司法部、卫生与公众服务部以及参议院。QTFY 向包括中国国家安全部在内的客户出售黑客服务，并利用该僵尸网络隐藏恶意流量。扣押域名使僵尸网络的命令与控制服务器无法运作，因其代码中硬编码了这些关键通信域名。美国网络安全局此前发布通告称，黑客虽扫描过相关网络但未成功获取访问权限。