FBI seizes domains of Chinese botnet used to hack NASA, Senate and Department of Justice

The FBI seized a series of domains used by a large-scale botnet to coordinate and launch cyberattacks attributed to the Chinese government against American targets. According to a statement from the U.S. Department of Justice released on Wednesday and reported by TechCrunch, the seizures cut off the operators' access to the platforms that controlled the network.

The botnet was allegedly used by the Chinese government to hack computers across U.S. territory, including hospital systems, defense contractors and several federal departments.

Who's behind it and how it worked

Prosecutors say the Chinese state-sponsored group, known as QTFY, was operated by a company called Nanjing Xinjiuwei Network Tech, which created and maintained a botnet made up of thousands of compromised internet-connected devices.

The key technical point: this network wasn't used just to launch direct attacks, but as an obfuscation network. In practice, the attackers' malicious traffic was routed through these compromised third-party devices, masking the real origin of the activity and making detection and attribution harder. It's the same principle as hiding an attack's source behind distributed proxies, only operated at scale and with hijacked devices.

According to the Department of Justice, QTFY worked as a service: it offered hacking capabilities to clients, including Chinese government hackers working for the Ministry of State Security (MSS), allowing them to use the botnet's infrastructure. It's the "hacking as a service" model applied to state operations, a trend that blurs the line between criminal groups and government-sponsored actors.

The scope of the attacks

The attacks date back to 2018 and affected NASA, the Federal Reserve (the U.S. central bank) and the Departments of Energy, Justice and Health and Human Services. The U.S. Senate was compromised as recently as 2026, according to the sworn statement the government submitted to the court to obtain the domain seizure order, filed earlier this week.

The operation's longevity, nearly eight years, is the most uncomfortable data point: it shows that command-and-control infrastructure can persist for years, hitting extremely high-value targets, before being dismantled.

Why seizing domains takes down the operation

The choice to seize domains rather than just arrest people has a direct technical logic. The Department of Justice states that the seizures rendered the botnet and its command-and-control (C2) servers inoperable, because the domains were hardcoded into the botnet's code and were critical to the network's communication and essential operations.

When the C2 address is fixed in the malware's binary, taking control of those domains (via sinkholing or seizure) cuts the communication line between the infected devices and the operators. Without receiving orders, the botnet loses coordination. It's a lesson in defensive and offensive architecture at the same time: fixed addresses are a single point of failure, and it was exactly through that point that the operation was neutralized.

Networking giant Lumen said in a blog post that it had been observing the attackers profiling and targeting government agencies and the defense and aerospace sectors over the past year, and that it shared threat intelligence with the FBI. The collaboration between private infrastructure operators and public authorities was part of what made the takedown possible.

What this changes for those building software in Brazil

The case is American, but the mechanics are global and directly concern those who develop and operate systems here. Some practical points:

• Your server can become part of a botnet without you attacking anyone. Misconfigured IoT devices, forgotten cloud VMs, routers with default credentials and exposed containers are exactly the kind of "compromised connected device" that makes up obfuscation networks. In Brazil, where IoT adoption and cloud infrastructure are growing without the same pace of security maturity, this is a concrete risk.

• Critical infrastructure is a long-term target. Public agencies, hospitals and energy companies were victims in this case. Developers working with health systems, the public sector or essential services in Brazil need to treat security as an architectural requirement, not as an optional layer added at the end.

• Detecting anomalous traffic matters as much as blocking the initial breach. Since the botnet's goal was to hide the origin, monitoring unusual outbound traffic (a server pinging strange domains, persistent connections to C2) is as relevant as protecting the entry point.

• Threat intelligence sharing works. Lumen's involvement shows the value of operators and companies collaborating on incident response. In Brazil, CERT.br and CTIR Gov play a similar role, and reporting compromised devices feeds this ecosystem.

What remains open

The domain seizure neutralizes the current infrastructure, but doesn't prevent the operators from rebuilding the network with new domains or more resilient C2 mechanisms, such as domain generation algorithms (DGA) or peer-to-peer channels. There is, so far, no public information about arrests or about the full extent of the data exfiltrated from the compromised agencies over the years of operation. For developers, the takeaway remains the same regardless of the answer: basic security hygiene on every machine you provision is what keeps it from becoming a brick in the next botnet.