US says Chinese cyber spies targeted hospitals, government agencies and the military

By Sean Lyngaas, CNN

(CNN) — US officials on Wednesday exposed a major alleged Chinese cyber-espionage campaign they say has compromised or attacked numerous federal agencies including NASA, the Federal Reserve, the departments of Justice and Energy and the US Senate.

Hackers affiliated with the Chinese military and intelligence services allegedly used a Chinese tech company to try to cover their tracks, burrow into target networks and make their attacks more efficient. Other targets include US military networks, hospitals, power companies and defense contractors, according to the Justice Department.

The department tried to stop further damage on Wednesday by seizing three internet domains affiliated with the Chinese company. Federal agencies also plan to release an advisory on the hackers’ techniques so victim companies can kick the intruders out.

The full impact of the spying effort was not immediately clear. Any counterintelligence assessments of the damage by US officials are likely to remain private due to security concerns.

The hacking began in 2018 and continued through 2026, according to an affidavit written by an FBI agent in support of the domain seizures. The affidavit lists three unnamed Department of Energy National Laboratories, the National Institutes of Health, and a Department of Health and Human Services agency, among other organizations, as “victims” of the hackers, indicating successful break-ins. The affidavit says the Department of Justice, the Federal Reserve, NASA and the Senate, among other entities, were “targeted” by the hackers.

The announcement highlights the latest in a number of long-running alleged Chinese hacking campaigns against core American infrastructure like power plants and banks.

Cybersecurity has been a source of simmering tension for years in the US-China relationship, flaring at moments of high-profile hacks, such as when US officials in 2023 began accusing China of hacking military transportation networks, water plants and power firms to potentially sabotage any US response to a Chinese invasion of Taiwan. US officials expressed outrage at that activity, arguing that there was no legitimate intelligence purpose for infiltrating those targets. China denied the allegations.

US officials and America’s biggest phone companies also spent months in 2024 digging out from China’s alleged infiltration of telecom networks. Then-presidential candidate Donald Trump and running mate JD Vance were among the targets.

Asked on Fox News on Wednesday whether Trump would bring up the latest alleged hacking activity with Xi Jinping when the Chinese leader visits the US next month, Attorney General Blanche responded: “I’m not going to tell President Trump what he needs to talk to the leadership about in China.”

Blanche also said: “This is something that we have talked about with our counterparts in China for many, many years. And we know that it’s happening. And they know that we know that it’s happening. And it has to stop.”

CNN has asked the Chinese Embassy in Washington for comment. The Chinese government routinely denies US hacking allegations and in turn accuses US spy agencies of cyberattacks.

Extensive effort to unravel operation

Wednesday’s announcement was in some ways the culmination of an intense spy-on-spy affair. The FBI, and likely America’s powerful signals intelligence agency, the National Security Agency, spent months, if not years unraveling a high-tech deception operation that China allegedly used for the hacking. It allegedly involved a Chinese firm based in the eastern city of Nanjing called Nanjing Xinjiuwei Network Technology Company. The company was established in 2018 and had 17 employees as of last year, according to Chinese business records.

Employees of the company include former members of China’s People’s Liberation Army, who “use their PLA relationships to obtain contracts and subcontracts supporting offensive cyber operations,” according to the court affidavit.

CNN has attempted to reach the Nanjing-based company for comment. The firm recently posted job ads for cybersecurity engineers capable of “large-scale penetration projects,” CNN found from a review of Chinese job recruitment websites.

China’s military and its Ministry of State Security used the company’s services to blend in with everyday internet traffic, according to US officials.

The hackers went on “to systematically profile and interact with target infrastructure on a global scale while remaining safely hidden within routine consumer network traffic,” Lumen Technologies, a US tech firm with visibility into the backbone of the internet, said in blog post on Wednesday.

While the use of the Chinese firm allowed the hackers to hide their hand in some ways, it also may have left a paper trail for investigators to follow, said Damon Rouse, a senior security engineer at Lumen’s Black Lotus Labs threat intelligence division, who has spent months investigating the activity.

“If you’re getting paying customers, you have a paper trail,” he said.

Rouse has long studied different ways that suspected Chinese hackers have routed their online activity to try to hide it, but he said the Chinese tech firm’s services are the most comprehensive he has seen.

“I hadn’t seen a fully self-contained ecosystem like this in my career,” Rouse told CNN.

It’s far from the first time, though, that Chinese spy agencies have allegedly leaned on the country’s bustling tech scene to kickstart computer intrusions worldwide.

A massive leak of files in 2024 from another Chinese company showed a client list that include Chinese police, intelligence and military organizations, and victims that included Tibetan exile-run political groups and hospitals in Taiwan.

“China’s hackers have professionalized significantly in the last decade,” said Dakota Cary, who is China analyst at security firm SentinelOne. “Companies offering services to the state have proliferated and now offer niche services. Not only do these companies make China’s hackers more effective, they make it harder for defenders to cluster activity.”

Wednesday’s actions from the US government “are necessary to disrupting China’s operations at scale, but the robust market for offensive services in China guarantees their return to operations,” Cary told CNN.

CNN’s Hannah Rabinowitz and Yong Xiong contributed reporting.

This story has been updated with additional information.

The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.