CYBER WARFARE
2 RECORDS ACCESSED MATCHING DOMAIN DIRECTIVE
China-Linked Cyber Campaign Targeted Persistent Access Across U.S. Systems
On August 26, the U.S. Justice Department announced the disruption of a China-linked cyber-espionage operation that utilized a vast network of compromised devices and commercial proxies. The disclosure points to a systemic security challenge: this specific campaign highlights a strategy focused on preserving long-term access across federal networks rather than relying on isolated breaches. According to a Reuters report detailing the DOJ announcement, U.S. authorities stated the campaign targeted NASA, the Federal Reserve, the Senate, the Department of Justice, the Department of Energy, and the Department of Health and Human Services. Federal investigators noted that the malicious activity linked to this operation extended back to at least 2018. To execute the campaign while obscuring its origins, the operators deployed malware identified as QScan and QTRouter to hijack residential routers and servers. As detailed by Wired , this infrastructure allowed attackers to route malicious traffic through systems that appeared entirely legitimate. For federal defenders, the challenge is no longer just stopping a single, noisy breach— it is hunting for unauthorized access deliberately buried inside ordinary internet traffic. The cyber allegations align with a documented history of Chinese intelligence activity aimed at U.S. government information. Earlier unsealed Justice Department cases detailed concerted efforts to recruit personnel with access to sensitive material, including a direct attempt to recruit a U.S. government employee as an intelligence asset (DOJ Archives ). While authorities have not explicitly merged this specific cyber operation with those past espionage arrests, the pattern suggests an analytical reality: digital incursions are often part of a broader intelligence effort that includes human asset development. What remains unconfirmed by current disclosures is the exact extent of the access retained inside the affected networks and the specific volume of information obtained. The breadth of the targeted institutions—spanning space operations, federal law enforcement, public health, energy policy, and monetary systems—demonstrates that the scope of the campaign spans multiple layers of U.S. governance. While the DOJ successfully disrupted the identified QScan and QTRouter proxy infrastructure, federal security teams face the ongoing burden of auditing these sprawling systems to ensure no secondary footholds remain active.
China and North Korea Push Into Different Layers of U.S. Networks
The warnings coming out of Washington over the past year point to two different routes into U.S. networks. One runs through telecommunications backbones and high-value systems. The other moves through job applications, payroll systems and crypto rails, turning ordinary companies into both access points and revenue streams. The Infrastructure Breach According to official enforcement actions and public victim notifications disclosed in August and September 2025, the PRC-linked Salt Typhoon campaign had infiltrated multiple telecommunications companies, stolen personal data tied to millions of Americans and triggered victim notifications in at least 80 countries. That followed a March 2025 Justice Department indictment against Chinese nationals tied to the PRC government and APT27, alleging years-long intrusions into U.S. technology firms, defense contractors, municipalities, universities and infrastructure linked to the Treasury Department. According to DOJ charging papers , some of the stolen data was later brokered for sale rather than simply held for intelligence use. The Economic Infiltration The North Korean track looked different, but no less embedded in civilian systems. In a June 2025 enforcement action, the Justice Department announced nationwide action against DPRK remote IT worker schemes, including searches of 29 suspected laptop farms across 16 states. Prosecutors said workers using false identities obtained jobs at more than 100 U.S. companies and, in some cases, reached export-controlled military technology. The same cases included the theft of more than $900,000 in virtual currency, tying employment fraud directly to illicit finance. By March and April 2026, Treasury releases and Justice Department statements described a wider funnel. Authorities said DPRK-linked facilitators had converted about $2.5 million in illicit IT-worker earnings into cryptocurrency. In a related U.S.-facilitator scheme, authorities said at least 80 stolen identities were used to place workers at more than 100 American companies and generate more than $5 million for the regime. A Durable Shift The campaigns are not the same, and public enforcement actions have not described them as coordinated. But the cases do point to an emerging pattern across civilian infrastructure. Chinese-linked actors have been accused of seeking persistent access inside communications systems and other sensitive networks. North Korean operators, under sanctions pressure, have used remote work fraud and digital payments to raise money from inside the U.S. private sector while gaining another route into company systems. That leaves a harder, still unsettled problem than any single indictment or takedown. The cases suggest civilian networks are increasingly being used in more than one way at once: as places to collect data, maintain access, move money and exploit false identities. Whether that amounts to a durable shift is still playing out across court filings, enforcement actions and the companies caught in the middle.