The US Department of Justice has revised an earlier statement about a Chinese state-sponsored hacking campaign, clarifying that several major US government institutions were targets but were not necessarily successfully hacked.The correction narrows the scope of the breaches previously described by the department. The revised statement says organisations including the US Senate, Federal Reserve and NASA were among the targets of the Chinese hacking group QTFY, but the government’s evidence distinguishes between attempted intrusions and confirmed compromises.The Justice Department updated its August 26 release on Friday, saying the changes were made to accurately reflect allegations contained in an FBI affidavit supporting the seizure of infrastructure used by the hackers.
What did the US correct?
The department initially described several agencies as victims of the cyber campaign. The revised language now says they were “among the targets” of QTFY.The distinction is important because being targeted does not necessarily mean that hackers gained access to a network or stole data.According to the FBI affidavit, QTFY actors have targeted US federal networks since at least 2018. The list includes NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and, in 2026, the US Senate.
NASA attack attempt was unsuccessful
The FBI affidavit provides one clear example of an unsuccessful intrusion attempt.
The bureau investigated QTFY's targeting of NASA and found that the attempted breach did not succeed because NASA had patched the software targeted by the hackers.The affidavit, however, says some other organisations were successfully compromised. It alleges that in September 2024, QTFY actors carried out computer intrusions involving three Department of Energy national laboratories, the NIH, an HHS agency and a US security-device manufacturer.
US says Chinese group operated hacking infrastructure
The Justice Department and FBI say QTFY is a China-based, state-sponsored hacking group linked to Nanjing Xinjiuwei Network Technology Company.According to US court documents, the group operated hacking platforms known as QScan and QTRouter. QScan was used to scan and infect internet-connected devices, while QTRouter helped conceal the origin of cyber intrusions by routing malicious traffic through compromised devices and other infrastructure.The US authorities seized domains associated with the platforms through court orders on August 26, disrupting their operation. The FBI said the group had targeted US critical infrastructure and other sensitive networks.
China rejects US accusations
China has previously rejected US allegations of state-backed cyber activity. A Chinese embassy spokesperson accused Washington of using cybersecurity claims to “smear or discredit China” and said Beijing opposed the US using national security as a justification for restrictions on Chinese companies.The embassy had not immediately responded to Reuters' request for comment on the latest correction.
Why the correction matters
The revised wording does not erase the US government's broader allegation of a long-running Chinese cyber-espionage campaign. Instead, it clarifies which systems were targeted and which were actually compromised.The FBI says QTFY activity targeting US and other networks dates back to at least 2018, while the latest operation involved disrupting the infrastructure the group allegedly used to conduct and conceal those attacks.
.jpg)
---copy---copy1.jpg)
