US Corrects Chinese Hacking Claims on NASA, Senate
The US Department of Justice revised its earlier claims, clarifying that while Chinese state-sponsored hackers targeted agencies like NASA and the Senate, they were not all successfully breached. This correction narrowed the scope of confirmed intrusions amidst ongoing cyber espionage allegations.
Key Highlights
- US DoJ revised initial statement on Chinese cyberattacks.
- NASA, Senate were targets, but not successfully hacked.
- Initial statement incorrectly listed all targeted agencies as victims.
- Chinese group 'QTFY' linked to Nanjing Xinjiuwei conducted operations.
- US disrupted hacking by seizing 'QScan' and 'QTRouter' domains.
- China denies allegations, calls them 'smear' tactics.
The United States Department of Justice (DoJ) issued a significant clarification regarding earlier statements that suggested Chinese state-sponsored hackers had successfully attacked several prominent U.S. government agencies, including NASA, the Federal Reserve, and the U.S. Senate. The initial announcement, made on Wednesday, August 26, 2026, implicated a Chinese state-sponsored hacking group identified as 'QTFY' in a years-long cyber-espionage campaign. This initial release described all mentioned agencies as 'victims,' implying successful breaches.
However, a revised statement from the DoJ, released on Friday, August 29, 2026, corrected this assertion, clarifying that while these organizations were indeed 'among the targets' of QTFY, not all were successfully compromised. This critical distinction was made to ensure the press release accurately reflected the government's allegations as detailed in an accompanying FBI affidavit, which revealed that 'all were targeted but only some were compromised.'
Specifically, the FBI's investigation found that an attempted intrusion into NASA's networks was unsuccessful. This failure was attributed to NASA's timely patching of the targeted software, demonstrating effective defensive measures. Similarly, attempts by the Chinese hacking group to access the networks of the U.S. Senate and a U.S. hospital in March 2026 were also thwarted. The Federal Reserve was also listed as a target, with the revised statement confirming it was not successfully hacked.
Despite these unsuccessful attempts against specific high-profile entities, the FBI affidavit did confirm successful 'computer intrusions' by the QTFY group. In September 2024, the hackers allegedly carried out breaches at three Department of Energy (DOE) National Laboratories, an agency within the National Institutes of Health (NIH), an agency under the Department of Health and Human Services (HHS), and a U.S. security device manufacturer. These entities were explicitly referred to as 'victims' in the affidavit. Furthermore, a separate joint cybersecurity advisory issued by the FBI, National Security Agency (NSA), and US Cyber Command's Cyber National Mission Force, published on the same Wednesday as the initial DoJ announcement, detailed successful data thefts from unnamed defense contractors, financial institutions, and universities in May 2024.
This extensive cyber-espionage campaign, which officials stated had been targeting U.S. federal networks since at least 2018, was attributed to QTFY, a group allegedly operating through a China-based company named Nanjing Xinjiuwei Network Technology Company. The U.S. authorities claim that Nanjing Xinjiuwei offered hacking services to various clients, including China's civilian intelligence agency, the Ministry of State Security (MSS), and its military arm, the People's Liberation Army (PLA).
The disruption of this hacking operation involved court-authorized seizures of two internet domains, 'QScan' and 'QTRouter,' which were integral to QTFY's infrastructure. These platforms were used for reconnaissance—identifying vulnerable devices—and for orchestrating and routing attacks while masking their origins. Lumen Technologies' Black Lotus Labs, a cybersecurity research arm, played a crucial role by tracking this 'quartermaster' infrastructure and sharing threat intelligence with U.S. government agencies. They described the 'quartermaster' as a sophisticated provider of services supporting Chinese cyber espionage, integrating reconnaissance, proxy orchestration, and operational routing into a reusable service layer.
In response to the U.S. allegations, a spokesperson for the Chinese Embassy in Washington vehemently denied the claims, accusing the U.S. of using cybersecurity concerns to 'smear or discredit China.' The embassy also stated that China 'opposes the US overstretching the concept of national security and using it as a pretext to impose discriminatory restrictions on Chinese companies and will firmly safeguard the legitimate rights and interests of Chinese companies.'
This incident highlights the ongoing and escalating cyber tensions between the United States and China, with significant implications for international relations, national security, and global cybersecurity frameworks. The clarification from the DoJ underscores the complexity of attribution and the importance of precise communication in such sensitive matters. The event is highly relevant to an Indian audience, given India's strategic relationships with both the US and China, its increasing focus on cybersecurity, and its own experiences with state-sponsored cyber threats.
Frequently Asked Questions
What was the initial claim made by the US Department of Justice?
On August 26, 2026, the US Department of Justice initially claimed that a Chinese state-sponsored hacking group, QTFY, had successfully attacked and compromised several US government agencies, including NASA, the Federal Reserve, and the US Senate.
How did the US revise its statement regarding the cyberattacks?
On August 29, 2026, the US Department of Justice revised its statement, clarifying that while agencies like NASA and the Senate were 'among the targets' of the Chinese hackers, they were not all successfully breached or 'hacked.' The correction was made to accurately reflect that some agencies were targeted, but only some were compromised.
Were NASA and the US Senate successfully hacked by Chinese actors?
No, according to the revised US statement and an FBI affidavit, an attempted intrusion into NASA's networks was unsuccessful due to timely patching. Similarly, attempts to access the US Senate's networks in March 2026 were also unsuccessful. These entities were targets, but not successfully compromised.
Which US agencies were successfully compromised?
The FBI affidavit indicated successful 'computer intrusions' in September 2024 at three Department of Energy (DOE) National Laboratories, an NIH facility, an HHS agency, and a US security-device manufacturer. Additionally, data was stolen from unnamed defense contractors, financial institutions, and universities in May 2024.
What was China's reaction to the US allegations?
The Chinese Embassy in Washington denied the allegations, stating that the US uses cybersecurity issues to 'smear or discredit China' and impose discriminatory restrictions on Chinese companies.