US authorities said they disrupted a China-linked hacking operation that had allegedly stolen sensitive data from more than 300 organisations and infiltrated several US government and research networks. The case highlights the scale of state-linked cyber activity and the use of commercial-style hacking services to target critical infrastructure, public bodies and private institutions.

The FBI and Justice Department seized three domains supporting QTFY’s QScan and QTRouter platforms, which scanned for vulnerabilities and concealed attacks through compromised internet-connected devices. Officials said QScan handled over two million tasks in one day in 2024, while successful breaches reportedly included three Energy Department laboratories, the NIH, an HHS agency and organisations in defence, finance and education; some attempted attacks, including against NASA, failed.