중국 해커, NASA·美 법무부·연준까지 침투

The United States says it has dismantled a China-linked hacking operation that spent years breaking into some of the country’s most sensitive institutions, including the Justice Department, NASA, the Federal Reserve and the Senate. According to an affidavit filed by an FBI agent in support of the seizure of the hacking platforms’ domains, the campaign ran from 2018 through 2026, targeting not only top federal agencies but also hospitals, telecommunications providers, power companies, financial institutions and defense contractors.

The affidavit names the Department of Energy, the Department of Health and Human Services and the National Institutes of Health, along with four unnamed companies in the United States and South Korea, among the confirmed victims. It also states the hackers scanned for vulnerabilities and made unsuccessful attempts to breach the U.S. Senate and an unnamed American hospital as recently as March of this year. The Justice Department identified the operation’s infrastructure as being run by a China-based firm, Nanjing Xinjiuwei Network Technology Company, whose client list, it said, included China’s Ministry of State Security, its civilian intelligence service, and the People’s Liberation Army. The department said it had seized the domains of two hacking platforms used in the campaign, known as QScan and QTRouter.

What stands out is not merely the scale, spanning eight years and reaching into institutions as varied as the central bank, the space agency, hospitals and power companies, but the fact that the campaign’s infrastructure is tied directly to China’s intelligence and military apparatus rather than to private criminal actors operating independently. This confirms, in the form of hard evidence rather than suspicion, that state-directed hacking against core American infrastructure has been sustained and systematic. The inclusion of companies in South Korea among the named victims means this is not simply someone else’s problem across the Pacific. It underscores that Korean firms and institutions sit squarely within the same hacking ecosystem.

Korea needs to treat this as more than a foreign news item and translate it into concrete lessons for its own cybersecurity posture, including tighter security around firms with defense and advanced technology ties, and closer coordination with the United States on tracking and responding to state-linked hacking operations. The Lee Jae-myung government’s relatively soft posture toward China, even as a state-directed hacking campaign has been operating for years and touching Korean companies directly, is not a stance Korea can afford to sustain. The gap between rhetoric about balanced diplomacy and the reality of an active security threat is a gap Korea can no longer justify indulging.