Loading malware…
QScan is a distributed reconnaissance and automated exploitation platform operated by the China-linked QTFY group, which U.S. authorities have associated with Nanjing Xinjiuwei Network Technology Company and the PRC Ministry of State Security enabler ecosystem. It conducts high-volume internet scanning and target profiling, including web scraping, TLS certificate collection, subdomain enumeration, CMS-plugin fingerprinting, application-banner collection, port mapping, and configuration and system fingerprinting. QScan incorporates a repository of more than 200 Python proof-of-concept exploits and has been used to identify and exploit vulnerabilities in internet-facing applications and IoT devices at scale. It automatically compromises susceptible IoT devices and enrolls them into the QTRouter proxy and obfuscation network, enabling downstream intrusion activity to be routed through compromised devices. QTFY activity using QScan has targeted government, defense, critical infrastructure, energy, water, communications, healthcare, financial services, higher education, research, and other sensitive sectors worldwide, with substantial targeting of U.S. entities. Court-authorized seizure of essential hard-coded communication and authentication infrastructure reportedly rendered QScan inoperable in August 2026.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
QScan is the reconnaissance and exploitation engine... QScan carries a database of more than two hundred proof-of-concept exploits written in Python, built for volume: webpage scraping, TLS certificate collection, subdomain enumeration, CMS plugin fingerprinting, and straight-up penetration testing at scale.
QScan is a distributed system that processes a large volume of internet scanning tasks, including malicious penetration testing... [and] included a database of over 200 proof-of-concept exploits written in Python and was designed for large scale employment.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QScan is the reconnaissance and exploitation engine... QScan carries a database of more than two hundred proof-of-concept exploits written in Python, built for volume: webpage scraping, TLS certificate collection, subdomain enumeration, CMS plugin fingerprinting, and straight-up penetration testing at scale.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
“QScan is harvesting more than vulnerability status—it’s harvesting operational secrets along the way,” including “unintentional disclosure of API keys and configuration details to scanners and crawlers.”
The QScan platform conducts reconnaissance against victim networks, including webpage scraping, TLS certificate collection, subdomain enumeration and penetration testing.
The QScan platform conducts reconnaissance against victim networks, including webpage scraping, TLS certificate collection, subdomain enumeration and penetration testing.
The QScan and QTRouter infrastructure was used “to hide activity and probe targets, including critical infrastructure.”
QScan est un outil de scan automatisé qui infecte des milliers d’appareils IoT à travers le monde.
“The ‘mq-task’ server hosted RabbitMQ message queues, which provided scanning tasks to a pool of worker nodes primarily housed on leased servers located outside of China.”
“QScan scans and automatically infects thousands of IoT devices worldwide, and then adds them to the QTRouter network of QTFY-controlled devices.”
QScan est un outil de scan automatisé qui infecte des milliers d’appareils IoT à travers le monde, les intégrant au réseau QTRouter.
“Attackers were able to hijack large numbers of routers, gateways, and other connected edge devices and turn them into anonymous relays.”
QScan and QTRouter formed a "shared scanning and obfuscation layer" used by Chinese state-linked operators.
By routing their malicious internet traffic through IoT devices (compromised by QScan) local to their victims, these Chinese hackers can blend in with legitimate users and remain undetected when scanning and attacking critical infrastructure and other targets.
“The seized domains were hard-coded into QScan and QTRouter malware. The domains supported essential malware functions, including communications and authentication.”
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.”
The takedown “removed infrastructure adversaries were using to hide activity and probe targets,” while hijacked devices were “turn[ed] into anonymous relays.”
108 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A QTFY platform described as supporting reconnaissance and target profiling. It relied on hard-coded domains for essential communications and authentication, making the service inoperable when those domains were seized.
Automated scanning platform that compromises thousands of Internet-of-Things devices and enrolls them into the QTRouter network. Its hard-coded operational domains supported essential communications and authentication functions; seizure of those domains rendered the platform inoperable.
A distributed, industrial-scale reconnaissance and exploitation platform used by QTFY. It queues scanning and exploitation tasks through RabbitMQ, stores results in Redis, and uses a large Python exploit database to identify and exploit internet-facing systems at volume.
China-linked malicious scanning and obfuscation platform used to identify targets, relay activity through compromised devices, and obscure the origin of operations targeting U.S. critical infrastructure and federal networks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.