{
    "archive_path": "archive/1788136536.079266",
    "base_url": "www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure",
    "basename": "",
    "bookmarked_date": "2026-08-31 00:35",
    "canonical": {
        "archive_org_path": "https://web.archive.org/web/www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure",
        "dom_path": "output.html",
        "favicon_path": "favicon.ico",
        "git_path": "git/",
        "google_favicon_path": "https://www.google.com/s2/favicons?domain=www.wired.com",
        "headers_path": "headers.json",
        "htmltotext_path": "htmltotext.txt",
        "index_path": "index.html",
        "media_path": "media/",
        "mercury_path": "mercury/content.html",
        "pdf_path": "output.pdf",
        "readability_path": "readability/content.html",
        "screenshot_path": "screenshot.png",
        "singlefile_path": "singlefile.html",
        "warc_path": "warc/",
        "wget_path": "www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/index.html"
    },
    "domain": "www.wired.com",
    "extension": "",
    "hash": "1FNP8315KF3ZJPGMW31E",
    "history": {
        "archive_org": [],
        "dom": [],
        "favicon": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--output",
                    "favicon.ico",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://www.google.com/s2/favicons?domain=www.wired.com"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-08-31T00:35:37.363564+00:00",
                "index_texts": null,
                "output": "favicon.ico",
                "pwd": "/data/archive/1788136536.079266",
                "schema": "ArchiveResult",
                "start_ts": "2026-08-31T00:35:36.716235+00:00",
                "status": "succeeded"
            }
        ],
        "git": [],
        "headers": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--head",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-08-31T00:35:37.786919+00:00",
                "index_texts": null,
                "output": "headers.json",
                "pwd": "/data/archive/1788136536.079266",
                "schema": "ArchiveResult",
                "start_ts": "2026-08-31T00:35:37.373339+00:00",
                "status": "succeeded"
            }
        ],
        "htmltotext": [],
        "media": [],
        "mercury": [
            {
                "cmd": [
                    "/app/node_modules/@postlight/parser/cli.js",
                    "https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"
                ],
                "cmd_version": "1.0.0",
                "end_ts": "2026-08-31T00:35:53.555542+00:00",
                "index_texts": null,
                "output": "mercury",
                "pwd": "/data/archive/1788136536.079266",
                "schema": "ArchiveResult",
                "start_ts": "2026-08-31T00:35:49.544560+00:00",
                "status": "succeeded"
            }
        ],
        "pdf": [],
        "readability": [
            {
                "cmd": [
                    "/app/node_modules/readability-extractor/readability-extractor",
                    "/tmp/tmp0d0am23p",
                    "https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"
                ],
                "cmd_version": "0.0.11",
                "end_ts": "2026-08-31T00:35:49.529162+00:00",
                "index_texts": [
                    "For years, China's military and intelligence agencies, which carry out hacking campaigns against targets around the globe, have grown increasingly reliant on a vast web of proxy devices that enable and obfuscate their targeting. Now the FBI has named and disrupted one key network of those proxies\u2014and in doing so, revealed just how extensively the hackers who used it reached into American government institutions and US critical infrastructure.On Wednesday, the Department of Justice announced the takedown of two tools, known as QTRouter and QScan, used by a Chinese state-sponsored hacking group the DOJ identified as QTFY, which is allegedly part of a Chinese government contractor called Nanjing Xinjiuwei Network Technology Company. According to prosecutors and an FBI affidavit used to seize domains that those tools relied on, the company gave its customers access to botnets of hacked internet-of-things (IoT) devices and co-opted commercial proxy services. The company's customers\u2014allegedly including the Ministry of State Security and the People's Liberation Army\u2014then used those proxy services as relay points to carry out hacking campaigns stretching back as early as 2018, according to the US government.The DOJ says the hackers targeted a staggering list of US victim agencies, including attempted hacks of the US Senate and the Department of Health and Human Services, and successful breaches of the Federal Reserve, the Department of Energy, the National Institute of Health, and the DOJ itself.Nanjing Xinjiuwei Network Technology Company could not be immediately reached for comment.The FBI's affidavit goes on to list types of US infrastructure and industries targeted via the proxy networks, too, including power companies, telecommunications providers, hospitals, financial institutions, and defense contractors\u2014though it does not confirm which of the targeted entities were successfully breached or to what degree.\u201cThe scale is really giant,\u201d says Damon Rouse, a threat intelligence researcher at Lumen Technology's Black Lotus Labs, which worked with the FBI and DOJ on the takedown operation. In a blog post about the operation, Black Lotus Labs describes the Nanjing-based company as a kind of \u201cquartermaster\u201d for China's hacking operations, one of several private contractors that increasingly provide key tools and infrastructure to China's state-sponsored hackers.\u201cThis is a very long-lasting campaign,\u201d Rouse says, \u201cand this company and these people involved in it have very close ties to the highest levels of the People's Liberation Army.\u201dQScan, according to Lumen and the FBI, was designed to scan for vulnerabilities in IoT devices that could be hacked and added to botnets of infected devices that served as proxies. The company's QTRouter service allegedly managed customers\u2019 access to that botnet network, as well as a network of commercial proxies known as virtual private servers that could simply be rented and used in hacking campaigns.Over the past year, Rouse notes, the group had transitioned to hijacking virtual private network (VPN) services typically used by Chinese citizens to route around China's Great Firewall censorship system. Proxying Chinese hacking operations through those VPNs, Rouse says, created a layer of obfuscation that mixed malicious traffic with the benign traffic of Chinese users seeking to access the open internet. \u201cIt made it difficult for us to see the bad, state-sponsored traffic because there was so much typical user VPN traffic in the nodes they were co-opting,\u201d Rouse says.The FBI and Justice Department say they've now disrupted the group's proxy infrastructure by seizing key domains hardcoded into QScan and QTRouter. Lumen, which serves as an internet backbone provider, says it also \u201cnull-routed\u201d certain domains, rendering them inoperable\u2014including the more recent system of co-opting censorship-bypassing VPNs.\u201cState-sponsored malicious hackers preying on America\u2019s critical infrastructure will be stopped and prosecuted,\u201d US attorney general Todd Blanche wrote in a statement, though the DOJ's announcement didn't appear to include charges against any individuals. \u201cWe are here to ensure security for the American people and will use every tool we have to keep that promise.\u201d"
                ],
                "output": "readability",
                "pwd": "/data/archive/1788136536.079266",
                "schema": "ArchiveResult",
                "start_ts": "2026-08-31T00:35:46.258458+00:00",
                "status": "succeeded"
            }
        ],
        "screenshot": [],
        "singlefile": [],
        "title": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-08-31T00:35:46.250541+00:00",
                "index_texts": null,
                "output": "FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure | WIRED",
                "pwd": "/data/archive/1788136536.079266",
                "schema": "ArchiveResult",
                "start_ts": "2026-08-31T00:35:46.189150+00:00",
                "status": "succeeded"
            }
        ],
        "wget": [
            {
                "cmd": [
                    "wget",
                    "--no-verbose",
                    "--adjust-extension",
                    "--convert-links",
                    "--force-directories",
                    "--backup-converted",
                    "--span-hosts",
                    "--no-parent",
                    "-e",
                    "robots=off",
                    "--timeout=120",
                    "--restrict-file-names=windows",
                    "--warc-file=/data/archive/1788136536.079266/warc/1788136537",
                    "--page-requisites",
                    "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) wget/GNU Wget 1.21.3",
                    "--compression=auto",
                    "https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"
                ],
                "cmd_version": "GNU Wget 1.21.3",
                "end_ts": "2026-08-31T00:35:46.175305+00:00",
                "index_texts": null,
                "output": "www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/index.html",
                "pwd": "/data/archive/1788136536.079266",
                "schema": "ArchiveResult",
                "start_ts": "2026-08-31T00:35:37.797147+00:00",
                "status": "succeeded"
            }
        ]
    },
    "icons": null,
    "is_archived": true,
    "is_static": false,
    "latest": {
        "archive_org": null,
        "dom": null,
        "favicon": "favicon.ico",
        "git": null,
        "media": null,
        "pdf": null,
        "screenshot": null,
        "singlefile": null,
        "title": "FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure | WIRED",
        "warc": null,
        "wget": "www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/index.html"
    },
    "link_dir": "/data/archive/1788136536.079266",
    "newest_archive_date": "2026-08-31T00:35:49.544560+00:00",
    "num_failures": 0,
    "num_outputs": 6,
    "oldest_archive_date": "2026-08-31T00:35:36.716235+00:00",
    "path": "/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/",
    "schema": "Link",
    "scheme": "https",
    "snapshot_id": "183aa9a5-d764-4a4e-9863-97c00ffa23f9",
    "sources": [
        "/data/sources/1788136536-import.txt"
    ],
    "tags": null,
    "tags_str": "",
    "timestamp": "1788136536.079266",
    "title": "FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure | WIRED",
    "updated": "2026-08-31T00:35:36.715702+00:00",
    "updated_date": "2026-08-31 00:35",
    "url": "https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"
}