Chinese State-Linked Hackers Deploy AI Inside U.S. Networks, Threatening Critical Infrastructure

Google reported that a Chinese-affiliated hacking collective employed artificial-intelligence applications inside compromised U.S. networks, enabling the use of victims’ compute power and credentials while minimizing detectable traffic. The group, known as QTFY and reportedly employed by Nanjing Xinjiuwei Network Technology, was the focus of a Justice Department and FBI takedown of the QScan and QTRouter platforms, which allegedly provided services to China’s Ministry of State Security and the People’s one outlet Army.

Court filings list a wide array of victims, from NASA and the Federal Reserve to multiple federal departments, hospitals, telecoms, power firms and defense contractors, though not every listed network was necessarily breached. On the same day, the White House issued a national emergency order to restrict foreign-produced bulk-power equipment, citing the expanding attack surface of IoT-connected grid components. The administration’s Cyber Strategy for America calls for hardening critical infrastructure and supply chains, underscoring that cyber threats extend beyond power plants to vendors and connected devices. Analysts warn that Chinese cyber capabilities will continue to grow, demanding a unified plan to safeguard infrastructure and private data.