FBI Seizes Domains of China-Backed Botnet Targeting U.S. Government

On August 26, 2026, the United States government announced a major cybersecurity disruption following coordinated federal action against malicious foreign cyber operations. The Federal Bureau of Investigation successfully seized a series of internet domains that were actively being used to operate a sophisticated botnet. According to official findings, the infrastructure was directly linked to a series of persistent China-backed cyberattacks directed against critical American targets and national institutions.

The United States Justice Department stated that these critical domain seizures effectively deny the foreign operators continued access to the digital platforms they relied on for their campaigns. Federal authorities identified the entity allegedly operating the malicious botnet as Nanjing Xinjiuwei Network Tech. Investigators noted that this corporate front functioned under the specific group name QTFY while orchestrating its digital intrusions into American networks.

The scope of the targeted organizations affected by the hacks spans several vital sectors of the United States government. Confirmed victims of the cyberattacks include the National Aeronautics and Space Administration (NASA), the Federal Reserve, and the United States Senate. Additionally, the malicious activity compromised the Departments of Energy, Justice, and Health and Human Services, representing a widespread breach of high-level federal infrastructure.

Critical threat intelligence leading to the disruption was provided by network giant Lumen. The corporation observed suspicious profiling and targeted reconnaissance directed at various government agencies and other vital industry sectors. Lumen subsequently shared this crucial data with the FBI, enabling federal law enforcement to trace the malicious activity, identify the infrastructure of Nanjing Xinjiuwei Network Tech, and execute the domain seizures.