A Chinese company sold access to hacked US networks to Beijing's intelligence services: Here's how the FBI took down the operation

The FBI dismantled a vast cyberespionage operation linked to China that for years infiltrated government and critical infrastructure networks in the United States by disguising its activity as normal internet traffic to evade detection by authorities and intelligence agencies.

Among the operation's targets were NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate itself, as revealed by the FBI in a court document cited exclusively by The Wall Street Journal.

Behind the network, dubbed QTFY by U.S. authorities, was a private Chinese company, Nanjing Xinjiuwei Network Technology, which had operated since 2018 under a business model that threatens national security: selling access to hacked networks and stolen information to Beijing's foreign and military intelligence services. In other words, it was not state-sponsored hackers operating directly, but rather a private intermediary monetizing large-scale espionage.

The mechanism, as explained by Brett Leatherman, the FBI's chief cybersecurity official, operated through a botnet, a global network of compromised devices that the company built by combining cloud services with thousands of hacked devices. The company provided its clients with devices called QTRouters, which connected them directly to that infrastructure. "We've seen, through this botnet, the targeting of entities and devices in more than 130 countries," Leatherman said.

In addition to the federal agencies mentioned, the operation targeted electric utilities, hospital systems, and even U.S. election systems, according to Leatherman.

The key to the operation, and what made it particularly difficult to trace, was its ability to blend in with legitimate internet traffic. Nanjing Xinjiuwei relied, among other techniques, on so-called "airport" networks- nodes operating from Chinese territory and marketed as a service to circumvent the Great Firewall, the censorship system that Beijing uses to restrict internet access within the country,  the WSJ reported.

Rumaisa Habib, a Ph.D. candidate at Stanford University who has studied this phenomenon, explained that thousands of these networks operate in China, where they are illegal but openly promoted on Telegram.

Damon Rouse, an engineer at Black Lotus Labs, the Lumen division that tracked this operation, summarized the benefit this scheme provided to the attackers: "It gives them a massive amount of plausible deniability to utilize networks like this." By hiding behind ordinary users and seemingly harmless traffic, it becomes much more difficult to attribute an attack with certainty to a specific state actor.

The takedown took place on Wednesday, when the FBI and the National Security Agency (NSA) seized several of the domains that supported the network's core functions. According to Leatherman, this action rendered the operation's platforms inoperable. U.S. authorities also published technical details on the group's operations to help other organizations identify and block similar activity in a timely manner.

So far, Nanjing Xinjiuwei has not released its version of events. China, however, has denied in the past that it carries out hacking operations, a stance that Beijing systematically reiterates whenever Washington accuses Chinese companies or agencies of such activities.