US authorities have disrupted an alleged Chinese state-sponsored cyber-espionage operation that targeted or breached sensitive networks including those of NASA, the US Senate, the Federal Reserve and the Departments of Justice and Energy, according to the Justice Department and court documents. Other targets included hospitals, telecommunications providers, power companies, financial institutions and defence contractors.
The expose in some ways marked the culmination of a rigorous spy-on-spy exercise by the FBI and the National Security Agency that spent months, or may be years, digging into a high-tech Chinese spy operation.
Even as the overall impact of the breach was not immediately clear, US officials are likely to refrain from divulging details of any counterintelligence assessments of the damage caused.
How did Chinese hackers carry out cyber-espionage campaign?
The hacking started in 2018 and continued through 2026, an FBI agent wrote in an affidavit.
According to the FBI affidavit, the hackers operated through a China-based technology company, Nanjing Xinjiuwei Network Technology Company, which US authorities allege provided offensive cyber capabilities to customers including China’s Ministry of State Security and the People’s Liberation Army.
According to the FBI affidavit, the hackers operated through a China-based technology company, Nanjing Xinjiuwei Network Technology Company, which US authorities allege provided offensive cyber capabilities to customers including China’s Ministry of State Security and the People’s Liberation Army.
CNN found that the company had recently advertised for cybersecurity engineers capable of working on “large-scale penetration projects”, based on Chinese recruitment websites.
Story continues below this ad
China’s military and its State Security ministry availed the company’s services to fuse with everyday internet traffic, according to US officials.
The hackers went ahead to “systematically profile” and “interact with target infrastructure on a global scale” while remaining under wraps and undetectable within routine consumer network traffic, Lumen Technologies — a US tech firm with visibility into the internet backend — wrote in a blog post on Wednesday.
How was the hack unravelled?
On Wednesday, the US departments tried to restrict further damage by blocking three internet domains affiliated with the Chinese company.
While the Chinese firm helped the hackers to hide their hand in some ways, it may have left a paper trail for investigators to track, said Damon Rouse, a senior security engineer at Lumen’s Black Lotus Labs threat intelligence division.
Story continues below this ad
“If you’re getting paying customers, you have a paper trail,” said Rouse, who has spent months studying different ways that suspected hackers in China have routed their activity to try to hide it.
However, he acknowledged that Nanjing Xinjiuwei Network Technology Company’s services were the most comprehensive among all he has seen so far. “I hadn’t seen a fully self-contained ecosystem like this in my career,” Rouse told CNN.
The Federal agencies are also mulling releasing an advisory on the techniques used by the hackers so that victim companies safeguard themselves from the intruders.
History of the Chinese hacking
Cybersecurity has been at the base of brewing tension between the US and China for years.
Story continues below this ad
US officials in 2023 accused China of spying into military transportation networks, water plants and power firms to potentially sabotage any US response to a Chinese invasion of Taiwan.
The American officials had argued that there was no legitimate reason behind such infiltrations.
Months were spent trying to break into China’s alleged infiltration of telecom networks in 2024, when then-presidential candidate Donald Trump and running mate JD Vance became the targets.
In the same year, an enormous leak of files from yet another Chinese company in 2024 showed a client list that includes Chinese police, intelligence and military organisations, spying on victims like Tibetan exile-run political groups and hospitals in Taiwan.
China has, however, consistently denied the allegations.
The Express Global Desk at indianexpress.com which delivers authoritative, verified, and context-driven coverage of key international developments shaping global politics, policy, and migration trends. The desk focuses on stories with direct relevance for Indian and global audiences, combining breaking news with in-depth explainers and analysis.
A major focus area of the desk is US immigration and visa policy, including developments related to student visas, work permits, permanent residency pathways, executive actions, and court rulings. The Global Desk also closely tracks Canada’s immigration, visa, and study policies, covering changes to study permits, post-study work options, permanent residence programmes, and regulatory updates affecting migrants and international students.
All reporting from the Global Desk adheres to The Indian Express’ editorial standards, relying on official data, government notifications, court documents, and on-record sources. The desk prioritises clarity, accuracy, and accountability, ensuring readers can navigate complex global systems with confidence.
Core Team
The Express Global Desk is led by a team of experienced journalists and editors with deep expertise in international affairs and migration policy:
Aniruddha Dhar – Senior Assistant Editor with extensive experience in global affairs, international politics, and editorial leadership.
Nischai Vats – Deputy Copy Editor specialising in US politics, US visa and immigration policy, and policy-driven international coverage.
Mashkoora Khan – Sub-editor focusing on global developments, with a strong emphasis on Canada visa, immigration, and study-related policy coverage. ... Read More
