U.S. authorities have taken control of a set of domains tied to a large botnet used to coordinate cyber intrusions against American targets. The action cuts off the network's access to the platforms it relied on for communication and control.
According to the Justice Department, the operation was linked to a China-backed group known as QTFY, which prosecutors say was run by Nanjing Xinjiuwei Network Tech. The botnet was built from thousands of compromised internet-connected devices and was used to mask malicious traffic, making the activity harder to trace.
Officials said the network had been associated with intrusions dating back to 2018, affecting organizations such as NASA, the Federal Reserve, and several U.S. government departments. The botnet was also described as a tool offered to customers, including actors connected to China's Ministry of State Security.
The seized domains were embedded in the botnet's code, making them essential to its command structure. With those domains now disabled, the system has been rendered inoperable, limiting its ability to coordinate further activity.
Threat intelligence shared by Lumen helped support the investigation, after the company observed the group targeting government, defense, and aerospace sectors over the past year. The case highlights how coordinated cyber defense can disrupt complex digital infrastructure and shape a safer connected future.
