US says Chinese cyber spies targeted hospitals, government agencies and the military

By Sean Lyngaas, CNN

(CNN) — US officials on Wednesday exposed a major alleged Chinese cyber-espionage campaign they say has compromised numerous federal agencies including NASA, the Federal Reserve, the departments of Justice and Energy and the US Senate.

Hackers affiliated with the Chinese military and intelligence services allegedly used a Chinese tech company to try to cover their tracks, burrow into target networks and make their attacks more efficient. Other targets include US military networks, hospitals, power companies and defense contractors, according to the Justice Department.

The department tried to stop further damage on Wednesday by seizing three internet domains affiliated with the Chinese company. Federal agencies also plan to release an advisory on the hackers’ techniques so victim companies can kick the intruders out.

The full impact of the spying effort was not immediately clear. Any counterintelligence assessments of the damage by US officials are likely to remain private due to security concerns.

The announcement highlights the latest in a number of long-running alleged Chinese hacking campaigns against core American infrastructure like power plants and banks.

Cybersecurity has been a source of simmering tension for years in the US-China relationship, flaring at moments of high-profile hacks, such as when the US officials in 2023 began accusing China of hacking military transportation networks, water plants and power firms to potentially sabotage any US response to a Chinese invasion of Taiwan. US officials expressed outrage at that activity, arguing that there was no legitimate intelligence purpose for infiltrating those targets. China denied the allegations.

US officials and America’s biggest phone companies also spent months in 2024 digging out from China’s alleged infiltration of telecom networks. Then-presidential candidate Donald Trump and running mate JD Vance were among the targets.

Asked on Fox News on Wednesday whether Trump would bring up the latest alleged hacking activity with Xi Jinping when the Chinese leader visits the US next month, Attorney General Blanche responded: “I’m not going to tell President Trump what he needs to talk to the leadership about in China.”

Blanche also said:“This is something that we have talked about with our counterparts in China for many, many years. And we know that it’s happening. And they know that we know that it’s happening. And it has to stop.”

CNN has asked the Chinese Embassy in Washington for comment. The Chinese government routinely denies US hacking allegations and in turn accuses US spy agencies of cyberattacks.

Wednesday’s announcement was in some ways the culmination of an intense spy-on-spy affair. The FBI, and likely America’s powerful signals intelligence agency, the National Security Agency, spent months unraveling a high-tech deception operation that China allegedly used for the hacking. It allegedly involved a Chinese firm based in the eastern city of Nanjing called Nanjing Xinjiuwei Network Technology Company. The company was established in 2018 and had 17 employees as of last year, according to Chinese business records.

China’s military and its Ministry of State Security used the company’s services to blend in with everyday internet traffic, according to US officials.

The hackers went on “to systematically profile and interact with target infrastructure on a global scale while remaining safely hidden within routine consumer network traffic,” Lumen Technologies, a US tech firm with visibility into the backbone of the internet, said in blog post on Wednesday.

While the use of the Chinese firm allowed the hackers to hide their hand in some ways, it also may have left a paper trail for investigators to follow, said Damon Rouse, a senior security engineer at Lumen’s Black Lotus Labs threat intelligence division, who has spent months investigating the activity.

“If you’re getting paying customers, you have a paper trail,” he said.

Rouse has long studied different ways that suspected Chinese hackers have routed their online activity to try to hide it, but he said the Chinese tech firm’s services are the most comprehensive he has seen.

“I hadn’t seen a fully self-contained ecosystem like this in my career,” Rouse told CNN.

It’s far from the first time, though, that Chinese spy agencies have allegedly leaned on the country’s bustling tech scene to kickstart computer intrusion worldwide.

A massive leak of files in 2024 from another Chinese company showed a client list that include Chinese police, intelligence and military organizations, and victims that included Tibetan exile-run political groups and hospitals in Taiwan.

“China’s hackers have professionalized significantly in the last decade,” said Dakota Cary, who is China analyst at security firm SentinelOne. “Companies offering services to the state have proliferated and now offer niche services. Not only do these companies make China’s hackers more effective, they make it harder for defenders to cluster activity.”

Wednesday’s actions from the US government “are necessary to disrupting China’s operations at scale, but the robust market for offensive services in China guarantees their return to operations,” Cary told CNN.

CNN’s Hannah Rabinowitz and Yong Xiong contributed reporting.

This story has been updated with additional information.

The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.