China hacked the Federal Reserve, the Senate, and NASA. Now Washington is moving on two fronts.

Two major national security actions landed on Washington in the span of about 24 hours this week, and the thread connecting them is the same: China, and the vulnerability of critical American infrastructure.

On Wednesday, August 26, the Justice Department and FBI announced they had seized the internet domains of two hacking platforms - QScan and QTRouter - that a Chinese state-sponsored group used to breach some of the most sensitive networks in the federal government. That same day, President Trump signed an executive order declaring a national emergency over the U.S. bulk-power system, citing foreign-made equipment as a threat to the electric grid. By Thursday morning, Congress had returned to Washington after pro forma recess, with the dual disclosures already generating pressure on both chambers to respond.

What the DOJ found

The Justice Department and FBI announced court-authorized domain seizures to deny malicious cyber actors access to two complementary hacking platforms known as QScan and QTRouter, used to target U.S. critical infrastructure and other sensitive networks. Court documents unsealed in the Southern District of California identified the group behind them as QTFY, employed by China-based Nanjing Xinjiuwei Network Technology Company.

Among the confirmed victims of QTFY intrusion activity are NASA, the Federal Reserve, the Department of Energy, the Department of Justice itself, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. Private-sector targets were broad too. A court filing said: "Other targeted networks include those operated by hospitals, telecommunications providers, power companies, financial institutions, and defense contractors."

The hacking began in 2018 and continued through 2026, according to an affidavit written by an FBI agent in support of the domain seizures. The U.S. Senate was targeted as recently as 2026, according to the government's affidavit. The NSA said in a separate advisory that the hackers scanned the networks but were unsuccessful in gaining access to the Senate's systems specifically.

QTFY members, according to the DOJ affidavit, include former members of the People's Liberation Army who used their PLA relationships "to obtain contracts and subcontracts supporting offensive cyber operations." QTFY was employed by Nanjing Xinjiuwei Network Technology Co. Its paying customers include the People's Republic of China's Ministry of State Security and the People's Liberation Army, the DOJ said.

How the platforms worked, technically: QScan scans and automatically infects thousands of internet-of-things devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers. The domain seizures rendered both platforms inoperable, according to the DOJ. The Justice Department did not detail the damage to the agencies or other targets from the computer intrusions.

Attorney General Todd Blanche framed the action as the latest round in an extended fight. "State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise," Blanche said in a statement issued Wednesday. Alongside the domain seizures, the FBI and National Security Agency published a joint cybersecurity advisory Wednesday detailing indicators of compromise tied to QTFY, based on the agencies' analysis of the group's activity. Lumen Technologies' threat intelligence arm, Black Lotus Labs, also released its own report on QTFY's tactics, techniques and procedures, giving network defenders a private-sector complement to the government's findings.

This is the fourth consecutive year the U.S. government has disrupted a major Chinese hacking operation. In 2024, the FBI disabled a botnet of infected internet-of-things devices that the PRC-sponsored group Flax Typhoon was providing to customers in the Chinese government. In 2023, the FBI disrupted a different botnet used by the PRC-sponsored group Volt Typhoon to conceal their exploitation of U.S. and foreign critical infrastructure.

The executive order: a national emergency for the grid

Hours after the DOJ announcement, the White House released Executive Order 14420. President Trump on August 26, 2026, signed Executive Order 14420 declaring a national emergency under the International Emergency Economic Powers Act and the National Emergencies Act with respect to risks associated with foreign-produced bulk-power system electric equipment.

Trump signed an executive order preparing to block utilities from connecting some foreign-made equipment to the bulk power system, including transformers, batteries, inverters and associated software and digital products. The order goes beyond just purchases. It also contemplates the replacement of already-installed equipment, allowing the Secretary of Energy to "impose conditions on the continued use, operation, maintenance, servicing, or updating of foreign manufactured or operated bulk-power system electric equipment acquired or installed before the date of this order."

The order bars certain future transactions involving foreign-produced power-system equipment when the Energy Secretary determines the equipment is tied to a covered foreign entity and creates an unacceptable risk of sabotage, remote access, supply disruption, or other national security threats. It does not apply to facilities used for local electric distribution.

The White House said growing electricity demand from advanced manufacturing, artificial intelligence and defense production has increased the importance of securing equipment supply chains. The administration did not identify specific prohibited vendors in its fact sheet. Implementation details are expected through Energy Department rules and security reviews.

Industry analysts noted the order updates and expands a 2020 action. According to Utility Dive, one energy policy analyst said the new order "builds off of 2020 Executive Order 13920, which focused on large power transformers from China," adding it was "an update and expansion." The same analyst warned there is potential for market confusion and said the definition of equipment "designed and developed by a covered foreign entity" - particularly software - would "raise a lot of questions."

By declaring a national emergency, Trump is positioning the foreign equipment issue as a threat requiring federal intervention rather than solely a matter of commercial procurement.

Washington's reaction: incomplete picture, real pressure

The Senate and House met only for pro forma sessions on August 24 and 25, with no legislative business, committee hearings, or votes conducted. Both chambers were scheduled to remain in a pro forma status until they convened again on August 27, 2026. That means the disclosures landed with Congress effectively out of town - a familiar pattern in August.

The State Department's public schedule for August 27 showed Secretary Marco Rubio in meetings and briefings at the White House, with no department press briefing scheduled. Deputy Secretary Christopher Landau met separately with Japanese Vice Foreign Minister Funakoshi Takehiro at State - a session held under closed press coverage, with no readout released.

The grid emergency order and the QTFY disclosure together create a compressed political timeline. Congressional Intelligence Committee members are expected to request a classified briefing on the full scope of the QTFY intrusions, given that the DOJ explicitly declined to detail what data, if any, was taken from the Federal Reserve, the Senate, or NASA. That gap - eight years of access to some of the most sensitive networks in the country, and no public accounting of what was exfiltrated - is likely to drive the first round of Hill hearings when the full session resumes.

What to Watch

• Classified briefings: Watch for Senate and House Intelligence Committee chairs to formally request a closed-door briefing from DOJ and NSA on the full damage assessment from QTFY's eight-year campaign. The DOJ's stated refusal to disclose intrusion details publicly will intensify that demand.
• Energy Department rulemaking: Executive Order 14420 requires the Secretary of Energy to develop rules governing which foreign-made equipment is prohibited and what conditions apply to already-installed systems. The first draft rules will signal which countries and vendors are effectively targeted - China is not named in the order's text.
• China trade and diplomatic fallout: With U.S.-China trade talks already strained by existing tariffs, the QTFY disclosure and the grid order together raise the question of whether the administration treats them as leverage in negotiations or as a clean break from engagement on infrastructure security.
• Senate return, September 8: The full Senate reconvenes with a continuing resolution deadline, the Farm Bill, and now two new national security items on the pile. Appropriators will face questions about whether CISA and DOE have sufficient funding to implement the new grid security mandate.
• Nanjing Xinjiuwei: The company named in the DOJ court filing as QTFY's employer has not yet appeared on the Treasury Department's OFAC sanctions list. A Treasury designation - or the absence of one - will be an early indicator of how far the administration intends to escalate.

Sources: U.S. Department of Justice press release | White House Executive Order 14420 | White House Fact Sheet | CNBC | CNN | TechCrunch | Time | Utility Dive | The Washington Times | State Department Public Schedule