US authorities (the DOJ and FBI) have neutralized global botnets and hacking infrastructure operated by Chinese state-sponsored hacker groups and private cyber contractors. The move is aimed at disrupting covert cyberattacks and intelligence-gathering activities targeting the critical infrastructure and government agencies of the U.S. and its allies, and eliminating critical threats to national security.

Simultaneous domain seizure and neutralization operations by law enforcement agencies

The U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) executed court-authorized law enforcement operations to seize and neutralize command domains and virtual private servers (VPS) for hacking platforms such as “QScan,” “QTRouter,” “Microscan,” and “FishHub,” which were operated by Chinese state-sponsored hacker groups and associated entities. These infrastructures involved Chinese companies such as Nanjing Xinjiuwei Network Technology and Integrity Technology Group, and were announced successively in August and October 2026. Law enforcement successfully incapacitated the entire functionality of the attack tools by seizing core domains essential for malware communication and authentication. The operations involved close coordination among government agencies, including the FBI San Diego Field Office, the DOJ National Security Division, CISA (Cybersecurity and Infrastructure Security Agency), and the NSA (National Security Agency), as well as private security firms such as Lumen Technologies’ Black Lotus Labs. The figure below shows the overall architecture of the multi-layered botnet.

The Structure of a Massive Botnet Exceeding 200,000 Infected Devices

Among the neutralized infrastructure, the large-scale botnets operated by “Raptor Train” and “QTFY” were viewed as particularly threatening. These botnets had infected and brought under their control over 200,000 IoT devices worldwide, including home and small office (SOHO) routers, network cameras (IP cameras), NAS (Network Attached Storage), and DVR/NVR devices. The attackers deployed a custom Mirai-derived malware called “Nosedive” directly into the devices’ memory, utilizing anti-forensic techniques that left no traces on the disk to lurk undetected for extended periods. The command-and-control structure consisted of three tiers (Tier 1: infected devices, Tier 2: C2 and payload servers, and Tier 3: the “Sparrow” management node), with remote operations timed to coincide with standard Chinese working hours (Monday through Friday, business hours). The attackers abused these infected devices as a proxy network (such as QTRouter) to access networks in over 130 countries worldwide while disguising the true origin of the attacks (mainland China).

Targeted Critical Infrastructure and Advanced Cyber Concealment Techniques

The Reality of Damage from Covert Operations Targeting Electric Power, Aviation, and Government Agencies

Targets of Chinese-affiliated threat groups (such as QTFY, Flax Typhoon, Volt Typhoon, and APT27) have broadly spanned critical infrastructure sectors in the United States, including government agencies, military, telecommunications, healthcare, and energy. Specifically, key institutions such as NASA (National Aeronautics and Space Administration), the Federal Reserve Board (FRB), the Department of Energy, the Department of Justice, the Department of the Treasury, and the U.S. Senate, as well as an electric utility in South Carolina, major airports in Japan and Poland, a natural gas and power company in Taiwan, and the Defense Industrial Base (DIB), were targeted for reconnaissance and attacks. The attackers used scanning platforms such as “Microscan” and “QScan” to automatically detect vulnerable smart devices on the internet, and attempted to infiltrate target networks using them as stepping stones. Although the scanning activity itself does not immediately imply a successful intrusion, it has functioned as preliminary reconnaissance combining unknown vulnerabilities (zero-days) and known vulnerabilities (n-days), and is analyzed as pre-positioning to paralyze infrastructure functions in the event of future contingencies.

Stealth Intrusion Methods via Abuse of Legitimate Tools and Proxies

The defining characteristic of the hacker group neutralized this time lies in the combination of advanced “Living off the Land” techniques that bypass traditional malware detection and proxy networks. The attackers abused legitimate system administration tools and commands natively present within the victim organization’s systems to roam the internal network in a manner indistinguishable from routine maintenance operations. Furthermore, by relaying access through infected consumer and corporate routers (such as QTRouter), they disguised their origin to make it appear as though they were accessing the network from near the target organization or from within the United States. Additionally, a multi-stage intrusion process was established, using phishing support tools like “FishHub” to send fraudulent emails posing as affiliated individuals and delivering file-theft or remote-control malware. Consequently, network perimeter devices with lax security monitoring (such as VPN devices and routers) were heavily targeted as initial intrusion vectors, enabling long-term information theft and persistence. The image below illustrates the concept of this intrusion process.

State-Sponsored Cyber Ecosystems and Future Defense Prospects

The Close Collaborative Structure Between Private Cyber Firms and Government Agencies

What was revealed by the US authorities’ investigation and indictments is the close cooperative relationship between state agencies such as China’s Ministry of State Security (MSS) and the People’s Liberation Army (PLA), and private hacking contractor companies (such as Nanjing Xinjiuwei and Integrity Technology Group). The Chinese government not only directly conducts state-sponsored cyber espionage, but also leverages networks of private operators and hackers-for-hire to scale up its attacks. These companies reportedly sold their self-developed hacking tools and stolen data to Chinese government agencies while simultaneously reselling acquired access rights and confidential information through data brokers to generate illicit profits. Against this cybercrime ecosystem, the U.S. Department of Justice is strengthening its policy to comprehensively strike at the attackers’ funding sources and operational infrastructure by simultaneously applying not only infrastructure seizures, but also the seizure of cryptocurrency, as well as personal sanctions and wanted designations (DOJ indictments and a maximum $2 million bounty set by the Department of State).

A New Phase of Cyber Defense and Key Points to Watch

This recent series of neutralization operations is part of defensive activities designed to proactively disrupt and alter adversary behavior, based on the United States’ new National Cyber Strategy. However, disrupting botnets and cyberattack infrastructure is merely a temporary victory, and threat actor groups tend to reorganize almost immediately by modifying their code and procuring new infrastructure. Therefore, the keys moving forward will be real-time threat intelligence sharing through public-private partnerships and the continuity of proactive infrastructure disruptions. In particular, it is essential to manage End-of-Life (EoL) devices that no longer receive security updates as well as vulnerable IoT devices, acquire strict access logs, and implement a zero-trust architecture. Looking ahead, global attention will focus on how effective international law enforcement cooperation can be, and how further regulations and technological containment measures against China’s public-private joint cyber infrastructure will progress.

Reference Page

• [U.S. Department of Justice (DOJ) Official Announcement: Seizure of Infrastructure Attack Platforms Operated by China-State-Sponsored Hackers] https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-platforms-operated-and-used-china-state-sponsored-hackers
• [Official FBI Announcement: Joint Announcement on the Disruption of a Global Botnet] https://www.fbi.gov/news/pressrel/press-releases/fbi-department-of-justice-announce-disruption-of-global-botnet
• [Official Announcement by the U.S. Attorney’s Office for the District of Columbia: Indictment of a Chinese Hacker Group and Associated Individuals] https://www.justice.gov/usao-dc/pr/chinese-nationals-ties-prc-government-and-apt27-charged-computer-hacking-campaign-profit
• [Published Paper in PLOS ONE: Analysis of the Inter-Sectoral Transmission of Geopolitical Risk] https://doi.org/10.1371/journal.pone.0330557

【#Cybersecurity #Botnet #USDOJ #FBI #ChineseHackers #InfrastructureDefense #NationalSecurity】