中国国家背景黑客组织“QTFY”潜入美国联邦机构与关键基础设施
PRC state-backed 'QTFY' hacking ring burrows into US federal agencies and critical infrastructure
- 解密法庭记录显示，中国官方支持的黑客攻破了美国国家航空航天局（NASA）飞行研究中心、美国财政部以及参议院系统。 Unsealed court records reveal Chinese state-sponsored hackers breached NASA flight centers, the U.S. Treasury, and the Senate.
- 该团伙通过南京商业技术外包商“新九纬”（Xinjiuwei）运作，该企业实为中国国家安全部的行动外包掩护机构。 Operated through a Nanjing-based commercial tech contractor (Xinjiuwei) serving as an operational cutout for the Ministry of State Security.
- 其攻击目标优先聚焦于太空推进技术、航天遥测数据以及金融结算网络，而非传统的常规外交沟通渠道。 Primary targeting prioritized space propulsion, aerospace telemetry, and financial settlement networks over routine diplomatic channels.
据《CyberScoop》报道，美国司法部解密的起诉书显示，受雇于南京科技企业新九纬的黑客侵入了美国国家航空航天局飞行研究中心、美国财政部及商业银行网络。该团伙作为国家安全部的商业外包掩护机构（代号“QTFY”），通过企业级VPN设备建立隐蔽隧道，在数月内持续窃取太空推进系统与航空航天设计蓝图的遥测数据。
起诉书揭示了北京利用商业外包掩护进行借口伪装掩饰的手法，这与此前国安部在海南和成都通过地方空壳公司展开的行动如出一辙。通过指使本土软件供应商实施入侵，国家安全部在获得行动可否认性的同时，也得以在外国关键金融机构与民用航天架构内部实现关键基础设施预置渗透与长期持久潜伏。
According to unsealed Department of Justice indictments reported by CyberScoop, contract hackers operating under Nanjing-based tech firm Xinjiuwei breached NASA flight research centers, the U.S. Treasury, and commercial banking networks. Operating as a commercial cutout for the Ministry of State Security under codename QTFY, operators tunneled through enterprise VPN appliances to siphon telemetry on space propulsion and aerospace blueprints over several months.
The indictment illustrates Beijing’s reliance on commercial front cutouts for pretextual cloaking, echoing previous MSS operations run through regional shells in Hainan and Chengdu. By directing intrusions through domestic software vendors, the Ministry of State Security secures operational deniability while pre-positioning persistent access inside critical foreign financial and civilian space architectures.
关于南京新九纬工商注册信息的讨论曾短暂出现在 V2EX 以及知乎的技术讨论帖中，但随后均遭删除；有程序员指出，该公司已匆忙注销工商登记并清空了办公场地。
Discussions regarding the Nanjing Xinjiuwei corporate registry surfaced briefly on V2EX and tech-focused Zhihu threads before deletions; programmers noted the company abruptly dissolved its business registry and vacated its office space.
官方媒体对美国司法部的起诉书全面噤声；在国家互联网信息办公室（CAC）的指令下，百度和微博对掩护公司“新九纬”的搜索关键词进行了严格限流与屏蔽。
State media completely suppressed the DOJ indictment; search queries for the front company 'Xinjiuwei' were throttled on Baidu and Weibo under Cyberspace Administration of China (CAC) directives.
新九纬受国家安全部江苏省国家安全厅指派运作；该部门此前曾于2018年因针对通用电气航空（GE Aviation）实施航天商业间谍活动而遭到美国起诉。
Xinjiuwei operated under the tasking of the MSS Jiangsu State Security Department, the same unit previously indicted in 2018 for aerospace corporate espionage targeting GE Aviation.