The Part They Can't Seize

I. The shutdown

On the morning of August 26, at the request of federal prosecutors in San Diego, three internet registrars locked a set of domain names and redirected them to servers belonging to the FBI.¹ The names — qt-team.com, qt-proxy.org and qtproxy.xyz — were not websites anyone visited. They were the addresses a piece of Chinese hacking software checked when it needed instructions, and the addresses it consulted to confirm a customer had paid for access. Redirect them and the software keeps running, keeps calling home, and reaches nobody.

No one was arrested that day and no indictment named anyone. The government asked a court for three domain names, got them, and two platforms that had been in continuous commercial service since 2018 stopped working.

The platforms were called QScan and QTRouter. The company that built and ran them was registered in Nanjing in 2018 as Nanjing Xinjiuwei Network Technology — XJW — and U.S. agencies track its personnel under the name QTFY. The Justice Department says the paying customers included China's Ministry of State Security, the country's principal civilian intelligence service, and the People's Liberation Army.¹

Over eight years, according to the advisory the FBI, the National Security Agency and the Cyber National Mission Force published the same day, the platforms were used against NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate.¹ The longer list in the advisory runs through defense contractors, telephone and internet carriers, semiconductor firms, hospitals, power companies, water utilities, universities and state election systems — the last of those approached without success in July 2019 and again in June 2026.² The FBI had been working the case since 2019.³

Taking the domains removed two products from a market that has other suppliers. The most useful material in the advisory is not the malware analysis but a section near the back, listing the other companies and government offices XJW did business with.

II. What the company sold

QScan did the finding. It held a library of more than two hundred break-in scripts written in Python, each built to exploit a specific published flaw in a specific product, and it ran them at a scale that is difficult to picture: on one day in 2024, customers pushed more than two million scanning and testing jobs through it.² It crawled websites, collected encryption certificates, guessed at hidden subdomains, identified which plugins a site was running, and when it found something unpatched, it broke in.

QTRouter did the hiding. Its operators wrote their own version of OpenWrt — the open-source software that runs inside consumer internet routers — and installed it on machines they had taken over. Those routers were chained together with rented commercial proxy services and leased cloud servers, so that traffic arriving at an American network appeared to come from an ordinary residential connection nearby rather than from an office in Nanjing.²

The list of products QTFY attacked shows the pattern. Pulse Secure. Fortinet. Citrix. Microsoft Exchange. F5. Kentico. Log4j. Atlassian Confluence. Ivanti. Check Point. CrushFTP. BeyondTrust.² Almost every one of them does the same job: it sits at the edge of a network and lets authorized people in from outside. A VPN appliance is the door an employee uses from home. A file-transfer server is the door a contractor uses to send drawings. A remote-support tool is the door the help desk uses to reach your laptop. Each of these is a lock on a door the owner installed on purpose.

The company also kept pace with public disclosure. In August 2019 it used a flaw in Pulse Secure's VPN software against the Justice Department, the Federal Reserve and NASA. In December 2021 it was exploiting Log4Shell within weeks of that vulnerability becoming public. In May 2024 it used a flaw in Check Point's gateway product to take data from more than three hundred organizations worldwide. In September 2024 it was using three flaws in Ivanti's software for which no patch yet existed. The most recent exploit in that product list is February 2026 — a flaw in BeyondTrust's remote-support product, used against a state government and an American water district. The advisory's activity record runs later still, into March and June 2026.²

A company that can do this is reading the same vulnerability disclosures as every network defender on earth and turning them into working tools faster than defenders can install the fixes, which describes a supplier rather than a spy service. The advisory goes on to describe the rest of the supply chain.

III. Who else was in the room

As of June 2026, the advisory says, XJW had business relationships with two units of the Ministry of State Security, with a regional branch of China's national vulnerability agency, and with at least four other private security firms.²

MSS Unit 0718. XJW did business with it. So did a company called Sichuan Zhixin Ruijie Network Technology, which U.S. and allied agencies associate with Salt Typhoon.²

Salt Typhoon is the operation that got inside American telephone and internet backbones and stayed there. In August 2025 thirteen countries signed a joint advisory describing a worldwide campaign against the routers that carry traffic between carriers and their customers, reaching telecommunications, government, transport, hotel and defense networks.⁴ Reporting at the time put the total near six hundred organizations, including roughly two hundred American companies across eighty countries.⁵ That advisory named three Chinese firms working for the MSS. One, Sichuan Juxinhe, had been sanctioned by the Treasury Department in January 2025. Another was Sichuan Zhixin Ruijie.⁶

The earlier public record placed QTFY in the general neighborhood of Salt Typhoon. The 2026 advisory places it in the same client's address book as a named Salt Typhoon contractor, one intelligence unit apart.

MSS Unit 9086, in Guangxi. XJW did business there too. In 2019, Unit 9086 held contracts with a company called i-Soon.²

i-Soon is the one the public already got to read. Its internal files leaked in February 2024 and exposed the working economics of China's hacking-for-hire market in the vendor's own spreadsheets. In March 2025 the Justice Department charged twelve people connected to it. According to those charges, i-Soon billed the Ministry of State Security and the Ministry of Public Security between $10,000 and $75,000 for each email inbox it successfully broke into, and sold the results to at least 43 separate government bureaus across at least 31 provinces and municipalities.⁷ Its American victims included a religious organization that sent missionaries to China, news outlets critical of the Party, the New York State Assembly and the Treasury Department.⁷

Two companies with no known relationship to each other were selling into the same intelligence service, through different units, in different provinces, years apart.

CNITSEC. The advisory records XJW's relationship with the Jilin branch of the China Information Technology Testing and Evaluation Center, and notes that as of September 2021 the branch was supplying vulnerabilities to the MSS 13th Bureau for review before publication.²

CNITSEC runs CNNVD, China's national vulnerability database — the government body whose stated job is to warn Chinese industry about newly discovered software flaws so they can be fixed. Researchers at Recorded Future identified CNITSEC as MSS-run and documented shared building addresses and telephone numbers between CNITSEC and CNNVD. Their analysis also measured the publication calendar. In their sample of 32 vulnerabilities exploited by malware linked to Chinese APT groups, the American national database beat CNNVD to publication 97 percent of the time, reversing CNNVD's usual speed advantage. They put the odds of that happening by chance at less than one in ten million.⁸

The sequence that describes is a flaw arriving at the national disclosure body, and intelligence officers getting to decide whether it is worth more to the state unpatched. The advisory places a QTFY business partner inside that process.

The rest of the list reads like a defense-trade directory. Nanjing Lexbell won a June 2025 contract to build data-mining and analysis tools for command-and-control system design. Bozhi Security Technology, which trades as Elextec, submitted three bids to the National University of Defense Technology the same month for power-system vulnerability detection. Fujian Ares Network Technology was finalist or winner on at least six of that university's projects between May 2023 and October 2025. Changyang Technology, known as Cy-Tech, describes itself as working in industrial internet security.²

Two further details from the advisory are worth reading closely. XJW's staff took part in China's freelance exploit-brokering networks, buying and selling access to already-compromised victim networks as a commodity, and competed on the attacking side of the domestic HW/HVV network exercises, where the state finds talent and the talent finds one another. And for the two years before the seizure, the group had been working hard to build artificial intelligence into its process.²

“Discovery of private companies building networks for China is becoming more frequent,” Ryan English of Lumen's Black Lotus Labs said after the seizure.³ Describing the Salt Typhoon contractors a year earlier, the SentinelOne analyst Dakota Cary put the arrangement's strangeness plainly: “It is inconceivable the U.S. would ask a private company to hack Xi's phone.”⁶

IV. Where the people come from

A market this deep needs a steady supply of trained people, and in China a great deal of that supply has come through one funding mechanism that predates every company named above. The 973 Program — the National Basic Research Program — paid for large, multi-institution science projects across Chinese universities and academies. Its recipients were not secret and its work was not classified.

Lionel Ni joined the Michigan State University computer science faculty in January 1981 and stayed until June 2003, and from August 1995 to July 1996 he ran the U.S. National Science Foundation's Microelectronic Systems Architecture Program in Arlington.⁹ He moved to the Hong Kong University of Science and Technology, and from September 2006 to August 2011 he was chief scientist of 973 project 2006CB303000, “Research on Fundamental Theory and Critical Technologies for Wireless Sensor Networks.”¹⁰ From November 2004 to December 2014 — a decade — he directed HKUST's IT Key Lab jointly with China's Ministry of Education and Microsoft Research Asia.¹⁰ He has held guest and adjunct appointments at the Chinese Academy of Sciences, Fudan, Beihang, Shanghai Jiao Tong and Tsinghua.⁹

Each of those is an ordinary distinguished-career entry. Together they describe one person holding open, for two decades, a channel running between an American university, an American federal science agency, a Chinese national research program, four mainland universities and Microsoft.

The same machinery turns up on a narrower branch, traceable through two papers eight years apart.

In 2014 the Journal of Software ran a survey of IP geolocation — the techniques for working out where in the physical world a given internet address actually sits. Its lead author was Wang Zhanfeng, and the listed affiliations were the PLA University of Science and Technology and 93615 PLA Troops in Tianjin. The work was supported by 973 grant 2012CB315806 and four grants from the National Natural Science Foundation.¹¹

In 2022 the same journal ran a survey by the same lead author on protocol reverse engineering — how to work out the structure of a proprietary communications protocol purely by watching the traffic it produces, with no documentation and no source code. Wang had moved to Southeast University. His co-authors were listed at Southeast University, at the PLA Army Engineering University's College of Command Control Engineering, at CNCERT — China's national computer emergency response center — and, in the case of Ma Weijun, at Nanjing Lexbell Information Technology.¹²

Nanjing Lexbell is the company that appears in the August 2026 advisory as an XJW business relationship, and that won a contract in June 2025 to build data-mining and analysis tools for command-and-control system design.²

The connection here is not direct or personal. It is the centrally planned institutional mechanism: national funding instruments, appearing across different generations, moving different people toward the same ends.

What that money bought is dual-use by construction. Working out where an internet address physically sits is how a streaming service routes traffic efficiently and how an operator locates a target. Reconstructing an undocumented industrial protocol is how an engineer audits a power plant's controller and how an intruder learns to talk to one. The knowledge is the same; only the customer differs.

None of this was concealed. China's 13th Five-Year National Informatization Plan stated that a system for civil-military integration in cyberspace had already been established, and called for shared laboratories, joint talent programs, movement of technology and capital between military and commercial sectors, military purchasing of commercial information products, and overseas research and data platforms.¹³ The contractor market did not grow up outside the state system. It grew up inside a published plan.

V. The builder

Jonathan Choi Koon-shum has run the Hong Kong conglomerate Sunwah Group — 新华集团, Xinhua Group — since 1976.

He sits on the Standing Committee of the Chinese People's Political Consultative Conference, the body that formally advises the Communist Party leadership and whose membership is the clearest public marker of political standing available to someone outside the Party apparatus. He was re-elected to its 14th term in March 2023 and filed thirteen policy proposals that session, most of them on Greater Bay Area development.¹⁴ He is a vice president of the China Overseas Friendship Association, one of the organizations through which the Party's United Front Work Department maintains relationships with ethnic Chinese communities abroad.¹⁵

Alongside that he is chairman of the Hong Kong Chinese General Chamber of Commerce, chairman of the Guangdong–Hong Kong–Macao Greater Bay Area Entrepreneurs Alliance, an economic adviser to the president of the Chinese Academy of Sciences, an independent non-executive director of BOC Hong Kong, chairman of the listed financial group Sunwah Kingsway, and chairman of VinaCapital in Vietnam. He was Hong Kong's representative to the APEC Business Advisory Council from 2015 to 2020. He holds the Grand Bauhinia Medal, Hong Kong's highest honor; France's Légion d'honneur; Japan's Order of the Rising Sun; Vietnam's Friendship Order; Cambodia's Royal Order of Sahametrei; and an honorary doctorate from Michigan State University.¹⁵

Nanjing. Sunwah formed its technology arm in 1998. Its relationship with Nanjing University dates to the 1990s. In 2002 Choi put RMB 700,000 into establishing the Choi Koon Shum Software R&D Centre, which worked on embedded-system software and hardware design. The host Electronic Engineering Laboratory listed among its projects embedded operating-system development, Linux system testing, and China's national Linux public testing platform.¹⁶ In March 2006 Nanjing University and Xinhua Science and Technology (Nanjing) System Software jointly filed a patent application for a method of booting a Linux operating system from a portable hard drive; it was published as CN101038551A on 19 September 2007.¹⁷ In January 2025 Choi gave the university ten million yuan for a 2,408-square-metre building, named 蔡继有楼 after his father, Choi Kai Yau. Inside it are the university's information-technology management center and a jointly built data center carrying Choi's own name.¹⁸

Nanjing University matters once more. NandaSoft — 南大苏富特, listed in Hong Kong as Jiangsu NandaSoft Technology, stock code 8045 — grew out of the university's software research and commercialization environment. Fu Tao was deputy director of the NandaSoft research institute before founding Bozhi Security in Nanjing on 7 August 2009.¹⁹ Bozhi calls itself a leading force in domestic cyber ranges, building for national defense cybersecurity and network confrontation and selling industrial-control security into defense, government, energy and transport; Fu Tao is its chairman.²⁰ It submitted three bids to the National University of Defense Technology in June 2025 and appears in the 2026 advisory as an XJW business relationship.²

Michigan State. In February 2004 the university's board of trustees recorded that Michigan State “has received a $5 million grant from the Hong Kong-based Sun Wah Education Foundation to study and compare the Chinese K-12 system with the U.S. K-12 system.”²¹ Choi holds an honorary Michigan State doctorate. Lionel Ni spent twenty-two years on the Michigan State faculty before taking the HKUST post from which he ran the 973 sensor-network project, and Anil Jain, Michigan State's University Distinguished Professor in biometrics, lists Tsinghua among his visiting appointments.²²

Fudan. Choi has been a member of Fudan University's board since 1997, serving all eight consecutive terms — twenty-eight years, by the university's own count in May 2025. The board is not a corporate governing body: Fudan's Ministry-approved charter describes it as consultative and deliberative, a link between the university and society and a means of raising resources.²³ A lecture hall bearing his name opened at the Journalism School in 2004 and a humanities building in 2005. On 29 May 2025 Sunwah and Fudan signed a renewed strategic cooperation agreement covering international cultural exchange, shared international platforms, academic development and talent cultivation, with named focus areas including journalism, finance, life sciences and global governance.²⁴

The hall — 蔡冠深报告厅 — has been used repeatedly for state and Party communications work. A national speaking tour organised by the Central Propaganda Department, the State Internet Information Office, the broadcasting and publishing regulator and the All-China Journalists Association opened its Shanghai leg there in December 2014. A lecture in March 2016 on implementing Xi Jinping's directives for Party news and public-opinion work was held in the same room, covering Marxist journalism, internet content governance and “telling China's story well.” In March 2017 it hosted the Shanghai promotional session for an international “Telling China's Stories Well” creative communication competition. And it is where the Shanghai municipal propaganda department and Fudan run their “China in the New Era” national-conditions lecture series, in 2022 and again in 2024 — one strand of a co-construction program that the university's 2022 account put at twenty-one years old and reaching six Shanghai universities.²⁵ Speaking at the signing on 29 May 2025, Choi put the relationship at twenty-eight years himself, named journalism and communication among the five fields the agreement targets, and said Sunwah now runs more than ten Choi Koon Shum cultural exchange centres worldwide, which he described as “actively serving as a bridge for people-to-people diplomacy,” inviting Fudan to hold joint events at them.²⁴

The Fudan board is also where this story touches the American security industry. Ming Hsieh has been a Fudan trustee since 2011, sitting on the board Choi has served on since 1997, and Fudan's current governance page lists him, as 谢明, among the regular members of its eighth board. Fulgent Genetics — the genetic-testing company Hsieh runs — repeated the trusteeship in the proxy statement it filed with the Securities and Exchange Commission in March 2026.²⁶ He has attended in person: Fudan's record of the third session of its seventh board, on 16 December 2022, lists 谢明 among the trustees who advised the university on its future direction. At a Greater Bay Area cooperation meeting in Guangzhou on 25 February 2023 he was represented by Liu Haiqing, sales director of Fulgent's Chinese arm, 福君基因.²⁷

Hsieh was born in Shenyang in 1956, came to the University of Southern California in 1981, and in 1990 founded Cogent Systems, which built the automated fingerprint identification systems used by the FBI and the Department of Homeland Security. He took Cogent public in 2004, sold it to 3M in 2010, and now runs the genetic-testing company Fulgent. Since April 2013 he has been a director of Fortinet.²⁸

Fortinet's board is one of the densest concentrations of American national-security leadership in the technology industry. Gary Locke — governor of Washington, secretary of commerce, and United States ambassador to China from 2011 to 2014 — joined it in September 2015.²⁹ When the company launched its federal subsidiary in May 2017, that subsidiary's board included Mike McConnell, a retired Navy vice admiral who had directed the National Security Agency and then served as director of national intelligence.³⁰ In November 2024 the parent board added Janet Napolitano, secretary of homeland security from 2009 to 2013.³¹

A flaw in Fortinet's FortiOS VPN software appears in the QTFY exploitation timeline for October 2019, and Fortinet firewalls are named in the 2025 Salt Typhoon advisory among devices those operators may target.^{2, 4} Being targeted is the ordinary condition of every company selling network-edge equipment; the same advisories name Cisco, Ivanti, Citrix and Palo Alto. The unusual part is the composition of the room — a company whose equipment is a standing objective for Chinese state operators, governed in part by the people who ran the American agencies charged with stopping them, and in part by a founder who built the federal government's fingerprint infrastructure and sat on the board of a Shanghai university beside a member of the CPPCC Standing Committee.

The academic side shows the same compression. Anil Jain, Michigan State's University Distinguished Professor of biometrics, wrote the textbooks that defined the field Cogent commercialized — and in April 2010 the U.S. Army awarded Cogent a contract worth $1.12 million to prototype a handheld device fusing face, fingerprint, iris, voice and periocular recognition for field use. Cogent held the prime award. The universities underneath it were Michigan State, USC and West Virginia — Jain's institution, the school whose electrical-engineering department Hsieh endowed, and a forensic-science program that in November 2007 had received $5.5 million from him, part cash and part in-kind gifts of Cogent biometric systems, and had dedicated a building as Ming Hsieh Hall; he gave the same program a further $250,000 in May 2014.³² Jain described the arrangement himself to the Army Science Board in March 2011: “Current ARL funding to Cogent Systems (with MSU, USC, WVU) is prototyping a system with face, finger, iris, voice and periocular traits.”³³

Michigan State's audited federal-award schedules record what reached it — $112,092 in the year to June 2011 and $35,400 the year after, booked as “COGENT DOD,” grantor Cogent, Inc.³⁴ Hsieh was Cogent's chairman, president and chief executive when the contract was signed. A filing that September put his holding, with entities he controlled, at roughly 39 percent of Cogent's shares as of 27 August 2010.³⁵ Defense money moving through his company into Jain's department is not the same thing as a gift from him, and the public record shows no personal Hsieh grant to Jain.

In December 2019 the Chinese Academy of Sciences elected Jain a foreign member, in Michigan State's own words “for his scientific achievements and contributions to promoting the development of science and technology in China.”³⁶

Ming Hsieh's own career carries the whole span. Cogent built the fingerprint systems the FBI and the Department of Homeland Security run on, and its Army prime contract routed federal biometrics money through Jain's department at Michigan State — the department from which Jain held his Tsinghua visiting appointment and was elected to the Chinese Academy of Sciences. Hsieh sold Cogent to 3M in 2010, took over Fulgent, and joined Fortinet's board in April 2013: the company whose FortiOS VPN flaw sits in the QTFY exploitation record and whose firewalls are named in the 2025 Salt Typhoon advisory. And since 2011 he has sat on Fudan's board beside Choi — in the room himself in December 2022, and represented by the sales director of his Chinese subsidiary in February 2023.

Choi is not named in the QTFY case, and no record cited here alleges wrongdoing by him. What the record shows is narrower and more durable: for forty years he has built and maintained the channels through which people, money, technology and access move between China and everywhere else, in public, with his name on the buildings.

VI. What can't be seized

American counterintelligence is built to find chains of command. It looks for the officer who gave the order, the cable that carried it, the money that paid for it, and when it finds them it seizes infrastructure, unseals indictments and imposes sanctions. On August 26 it took the infrastructure. No indictment was unsealed, no arrest was announced and no sanction was imposed, and the part it did do, it did competently.

The structure it disrupted has no chain of command. XJW sold capability. National research programs paid for the underlying science. Universities trained the people and companies hired them. Foreign partners — Microsoft, Michigan State, USC and the ordinary machinery of academic exchange — made those careers portable. Intelligence and military customers bought finished work from private vendors, which meant no single organization chart ever contained all the contributors.

The American side has its own version of the same compression. Fortinet's parent board seated a former ambassador to Beijing in 2015 and a former secretary of homeland security in 2024, alongside the founder who built the FBI's fingerprint systems and sits on a Shanghai university board; the board announced for its federal subsidiary in 2017 included a former director of the National Security Agency who went on to be director of national intelligence. These are public appointments, and the cited records do not allege wrongdoing on that basis. What it means is that the people who understand both ends of this transaction tend to be the same small set of people, moving between government and the vendors government buys from.

Ming Hsieh is the part of that room that complicates it hardest. Cogent sold the federal government the fingerprint infrastructure the FBI and Homeland Security run on, and the Justice Department — the FBI's own department — sits on the QTFY victim list. He has been on Fortinet's board since 2013 and on Fudan's since 2011. The former officials named on Fortinet's parent and federal-subsidiary boards led agencies that write the advisories those companies appear in, and Fortinet's own equipment appears in both: a FortiOS flaw in the QTFY exploitation record, Fortinet firewalls in the Salt Typhoon advisory.

The cited records describe public activities, many of which are also admirable when looked at alone. A joint doctoral program is a good thing. A funded data center is a good thing. Forty years of philanthropy honored by France, Japan, Vietnam and Hong Kong is, on the public record, forty years of philanthropy.

The difficulty for anyone trying to respond is that a modern state can draw operational power from institutions that look entirely ordinary one at a time, and the people who build those institutions are not hiding. The cited QTFY records do not allege wrongdoing by the named researchers or university partners.

The Justice Department took two platforms off the market in a morning. Everything upstream of them opened for business the next day.