QTFY

QTFY, also known as QT and QTCYBER, is a China-linked, state-sponsored cyber threat group active since at least 2018. U.S. authorities attribute the group to Nanjing Xinjiuwei Network Technology Co. (XJW), a Chinese cyber-enabling company with relationships to the Ministry of State Security and customers including the People’s Liberation Army. Its personnel include former military members and participate in freelance hacking, exploit-brokering, and cyber-contracting networks. QTFY provides paid hacking services and shared infrastructure supporting Chinese cyberespionage, including reconnaissance, exploitation, proxy management, and operational routing. QTFY targets government, military and defense-related networks, telecommunications providers, power and water utilities, financial institutions, healthcare organizations, technology companies, retailers, and universities. Its activity concentrates on the United States but extends internationally, including compromises of Taiwanese energy-sector systems. U.S. federal targets have included NASA, the Federal Reserve, the Department of Justice, the Department of Energy, federal health agencies, and the Senate. Targeting does not establish successful compromise, and several attempts against hospitals, election systems, and federal networks were unsuccessful. The group operates QScan, a distributed reconnaissance and exploitation platform, and QTRouter, a traffic-obfuscation network. QScan supports vulnerability scanning, web scraping, certificate collection, subdomain enumeration, and automated exploitation, with more than 200 proof-of-concept exploits and over two million scanning and penetration-testing tasks processed in a single day in 2024. QTRouter chains compromised routers and other IoT devices, commercial proxies, and leased servers to conceal operators and make traffic appear geographically local to victims. Associated botnet-management platforms include QTBotnet, which supports remote command execution and DDoS attacks. Fast Labyrinth and QTProxy provide additional relay and proxy-orchestration functions. QTFY exploits zero-day and known vulnerabilities in public-facing applications and edge appliances, including VPN gateways, file-transfer systems, remote-support products, and enterprise servers. It maintains access through remote-access trojans, web shells, and stolen legitimate credentials. A May 2024 campaign exploiting Check Point Quantum Gateway vulnerability CVE-2024-24919 resulted in data exfiltration from more than 300 organizations worldwide, including U.S. defense contractors, financial institutions, and universities. On August 26, 2026, U.S. authorities seized infrastructure essential to QScan and QTRouter communications and authentication, disrupting both platforms.