The U.S. Department of Justice said it disrupted a long-running Chinese state-sponsored hacking campaign by seizing domains associated with two malicious platforms, QScan and QTRouter. The operation, conducted with the FBI, rendered the botnet inoperable by removing the infrastructure used for command, control, and authentication.

The platforms were operated by a group identified in court documents as QTFY, which was employed by Nanjing Xinjiuwei Network Technology Company, a China-based firm.

DOJ filings allege QTFY’s clients included China’s Ministry of State Security and the People’s Liberation Army. QScan was used to infect thousands of internet-connected devices globally, which were then added to the QTRouter network to obfuscate the origin of attacks, making them appear to come from outside China.

The campaign, active since 2018, targeted U.S. critical infrastructure and sensitive networks.

Confirmed victims and targets include Department of Justice, NASA, Federal Reserve, Department of Energy, Department of Health and Human Services, and the National Institutes of Health. Others include the U.S. Senate, hospitals, telecommunications providers, power companies, financial institutions, defense contractors, and four unnamed companies in the U.S. and South Korea.

Notable specific incidents include a failed attempt to breach NASA networks via a VPN vulnerability in August 2019 and successful intrusions at three unnamed Department of Energy laboratories, the NIH, and an HHS agency in September 2024.

FBI Director Kash Patel said the tools were used by Chinese government actors to hide the origin of their attacks. Attorney General Todd Blanche described the seizure as the latest in a series of operations to dismantle PRC-sponsored hacking.

The Chinese Embassy in Washington said in a statement that the "Chinese government firmly opposes and combats all forms of cyberattacks," while Beijing routinely denies responsibility for such activities. This incident follows other recent Chinese-linked compromises, including breaches of U.S. House committee networks and major telecommunications companies.

Days before launching Operation Epic Fury on February 28, US President Donald Trump was reportedly warned by then-Director of National Intelligence Tulsi Gabbard that killing Supreme Leader Ayatollah Ali Khamenei would backfire by installing a more hardline successor eager for nuclear weapons.

Gabbard briefed Trump that attack on Iran will trigger the closure of the Strait of Hormuz, destabilize global energy markets, and prompt Iranian retaliation against U.S. forces and Gulf allies.

Despite these explicit intelligence assessments and similar cautions from Vice President JD Vance and senior military leaders regarding potential casualties and depleted stockpiles, Trump proceeded with the strikes, persuaded by Israeli Prime Minister Benjamin Netanyahu, US Defense Secretary Pete Hegseth and Joint Chiefs Chairman Gen. Dan Caine who argued for decisive military strikes.

The war has resulted in the death of Khamenei on the first day but failed to topple the regime or achieve a quick resolution as initially promised. The conflict is in its sixth month with 18 U.S. service members killed, 3,000 Iranians dead, and significant economic fallout including high oil prices and damaged American assets.

Gabbard, who had previously clashed with Trump over Iran’s nuclear timeline and was sidelined from pre-war planning, left the administration in May 2026, while the White House now faces pressure from Gulf allies and domestic political concerns to end a war that intelligence had predicted would have unwieldy consequences.

U.S. Treasury Secretary Scott Bessent on Monday, announced "Operation Economic Outcast," an "unprecedented" sanctions campaign described as an "economic D-Day" designed to sever every global financial lifeline sustaining the Iranian regime.

The initiative targets five critical sectors—digital assets, technology, gold, aviation, and shipping—and immediately sanctioned over 60 entities, individuals, and vessels involved in Iran's nuclear procurement, cyber operations, and oil smuggling.

Bessent said the operation presents a choice for the world: nations aligning with the U.S. will reap partnership rewards, while those maintaining economic ties with Tehran will face secondary sanctions** and isolation.

The Treasury Department asserted it has mapped every node and facilitator in Iran's evasion network, demanding that countries shut down identified activities within a defined but undisclosed timeline. Specific directives included the requirement that every branch of Bank Melli must be shuttered, with Bessent previewing a major sanction against a non-compliant financial institution by the end of the week.

While Bessent warned that "no one is above the reach of U.S. sanctions," including potential removal from the U.S. dollar system, the announcement stopped short of naming specific major Chinese banks, and offering a brief window for "quiet diplomacy" before further enforcement, ahead of a planned summit between President Donald Trump and President Xi Jinping.

In response, Iran stated it is "fully prepared" to counter with a two-year plan to manage the sanctions, relying on continued trade with China and Russia. Analysts note that the campaign's success hinges on whether China, which purchases roughly 90% of Iran's oil, complies with the U.S. demands.

China has vowed to take "all necessary measures" to safeguard its rights and interests if the United States expands secondary sanctions on Chinese entities trading with Iran. Foreign Ministry spokesperson Lin Jian said on Tuesday, that Beijing firmly opposes these "illegal unilateral sanctions" and warned that economic warfare would only intensify global tensions.

In response to previous US pressure, Beijing has already instructed domestic companies to ignore American sanctions and activated legal frameworks designed to neutralize foreign restrictions on Chinese firms.

Monday's announcement occurs amid a six-month war between the U.S./Israel and Iran, which has disrupted global energy markets and blocked the Strait of Hormuz.