US seizes major botnet domains linked to China

The US Federal Bureau of Investigation (FBI) has seized a number of domains belonging to a large-scale botnet network that coordinated cyberattacks linked to the Chinese government. According to a statement released by the Department of Justice on Wednesday, this measure has completely restricted the operators' access to management platforms and disabled the system. This is reported by Techcrunch.com reports .

It is reported that this botnet was used by the Chinese government to gain unauthorized access to computers at various critical facilities in the United States, including hospitals, defense contractors, and several federal government agencies. Prosecutors noted that the state-sponsored Chinese group known as QTFY was operated by a Chinese company called Nanjing Xinjiuwei Network Tech.

Botnet and its operating mechanism

The company created and operated a botnet consisting of thousands of compromised internet devices. The network primarily served as a masking layer, hiding the hackers' malicious traffic and making their activities difficult to detect. According to the Department of Justice, QTFY offered computer hacking services.

These services were also used by hackers working for the Chinese Ministry of State Security, who were able to utilize the botnet networks for their own purposes. The attacks date back to 2018 and have affected the NASA, the Federal Reserve System, and the Departments of Energy, Justice, and Health and Human Services.

Attacks on government agencies and the Senate

According to ixbt.com, citing court documents submitted by the government, the US Senate was even targeted by cyberattacks in 2026. This situation demonstrates that it has posed a serious threat to the security of the country's most important legislative and government bodies.

The Department of Justice stated that the seizure of the domains has completely halted the botnet and its command-and-control servers. The fact is that these domains were hard-coded into the botnet, making them critical for the network's communication and core operations.

Network giant Lumen wrote in a blog post that it had observed hackers targeting and monitoring government agencies, defense, and aerospace sectors over the past year. The company shared the intelligence gathered on these threats with the FBI, which played a crucial role in the investigation and the domain seizure process.