The U.S. Department of Justice has corrected its statement regarding a Chinese government-backed hacking group, in which it had referred to several federal agencies as “victims.” A correction stating that while NASA, the Federal Reserve, and the U.S. Senate were indeed targeted, none of them were actually compromisedWow.
On August 26, the Ministry of Justice announced that a hacking platform QScanand QTRouterThey announced that they had seized the internet domain used in the attack. Later, on August 28, they revised their statement to explain that while all agencies had been targeted, intrusions had been confirmed only at some of them.
In cybersecurity incidents, “attack attempts,” “successful intrusions,” and “data theft” are distinct stages. This correction is significant because it did not overturn the existence of the operation, but rather narrowed down the confirmed scope of damage more precisely.
| Replacing the term “victim” with “target”
The Justice Department's initial statement identified NASA, the Federal Reserve, the Justice Department, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate as victims of the hackers. The revised statement identified these agencies as having been targeted by a Chinese government-backed organization QTFYDescribe it as having been the target.
The Department of Justice stated that it revised the wording to accurately reflect the FBI affidavit supporting the search warrant. The original affidavit distinguished between agencies that were all targeted but only some of which were actually compromised.
In other words, the investigative agency did not withdraw the operation itself. It simply corrected the error of having combined the list of targets and the list of successful intrusions into a single announcement.
| Actual Infringement
If an attacker probes for vulnerabilities or attempts to log in or execute malware, the organization may become a “target.” If the defense system blocks the attack, it means there was an attempt, but the organization may not be a victim whose internal systems were compromised.
"A 'breach' refers to the stage where it has been confirmed that an attacker has gained access to a system and obtained privileges or tampered with data. After that, it must be verified separately whether any actual information has been leaked externally."
Without this distinction, the extent of damage at each agency may be reported as greater than it actually is, and evaluations of security responses could be distorted. Conversely, if we downplay it as a mere attempt, we risk overlooking the attacker’s ongoing reconnaissance and the associated risks, so it’s important to describe the steps accurately.
| Attack on NASA
According to an FBI statement, an attempted attack targeting NASA was unsuccessful because the agency had already patched the vulnerable software. Attempts to gain access to the U.S. Senate and a hospital in March 2026 were also classified as failed attempts.
In contrast, the affidavit stated that in September 2024, actual intrusions occurred at three national laboratories under the Department of Energy, the National Institutes of Health, one agency under the Ministry of Health and Welfare, and a U.S. security equipment manufacturer.
A separate joint security advisory stated that data exfiltration was successfully carried out in 2024 against certain anonymous organizations, including defense contractors, financial institutions, and universities. You should not attempt to establish a one-to-one connection between the targets whose names were disclosed and the organizations that actually suffered damage.
| QTFY, QScan·QTRouter
The U.S. Department of Justice has identified an organization allegedly employed by China's Nanjing Xinjiuwei Network Technology Company as QTFY...was its name. According to the Department of Justice, this organization created and operated QScan and QTRouter.
According to law enforcement, QScan was used to identify and infect vulnerable IoT devices connected to the internet, while QTRouter served as a relay network that grouped infected devices and rented servers together to conceal the origin of the attacks.
This makes it difficult to track and defend against the attacks because the attack traffic can be made to appear as if it originated from areas close to the actual targets or from devices outside China. However, these allegations are based on U.S. government investigative materials, and the Chinese side has denied the allegations.
| Domain Seizure
The U.S. Department of Justice and the FBI, acting under a court order, seized the domains that QScan and QTRouter used for communication and authentication. They explained that because the address was hard-coded into the malicious tool, the platform became inoperable after it was seized.
This approach allows for the neutralization of the attack infrastructure by severing the command-and-control and authentication channels, even without directly identifying and removing all infected devices. The U.S. government has previously employed similar technical operations against other China-linked malware and botnets.
However, seizing the domain does not restore data that has already been stolen or automatically repair all infected devices. Each organization and device owner must separately perform patching, log reviews, account protection, and malware removal.
| Official Correction
The most significant new information in this case is that, following the announcement of a large-scale hacking operation, the government The fact that a distinction was once again made between the target and the victimWow. It has become clear that while the scope of the attack attempts was broad, not all of the disclosed organizations were compromised.
Going forward, we’ll need to see which organizations have confirmed actual breaches and data theft, how many infected IoT devices remain, and whether additional indictments or sanctions will be imposed on the QTFY operators.
When reporting on security incidents, rather than relying solely on the initial announcement, you should also verify the revised official documents and court statements. This correction serves as an example of how, in a cyber incident, a single word can significantly alter the scope of the damage and public perception.
Tags
#U.S. Department of Justice #DOJ #FBI #QTFY #QScan #QTRouter #Cybersecurity #Chinese Hacking #NASA #Federal Reserve #IoT Security #Security Incident #Information Security
