Loading malware…
QScan is a distributed reconnaissance, vulnerability-scanning, and exploitation platform developed and operated by QTFY, a China-linked threat group associated with Nanjing Xinjiuwei Network Technology Company. U.S. authorities attribute QTFY to Chinese state-sponsored activity and identify China's Ministry of State Security and People's Liberation Army among its customers.
QScan profiles internet-facing systems and automatically compromises vulnerable Internet of Things devices, including routers and security cameras. Compromised devices are incorporated into QTRouter, a separate proxy and obfuscation network used to conceal the origin of malicious traffic. QScan provides reconnaissance and exploitation capabilities rather than the proxy-routing and botnet-management functions supplied by other components of QTFY's infrastructure.
The platform distributes tasks through a central broker to geographically dispersed scanning workers and collects results in a central database. Its architecture uses Celery and RabbitMQ for task distribution and Redis for results storage. Reconnaissance functions include webpage scraping, TLS certificate collection, subdomain enumeration, application fingerprinting, open-port mapping, and configuration discovery. QScan maintains more than 200 Python proof-of-concept exploits and processed more than two million scanning and penetration-testing tasks during a single day in 2024. Scanner workers rotate across network ranges to evade threshold-based detection.
QScan has supported operations against government, defense, telecommunications, energy, financial, healthcare, and higher-education organizations. Its documented exploitation activity includes Check Point Quantum Gateway vulnerability CVE-2024-24919 and BeyondTrust Remote Support vulnerability CVE-2026-1731. In August 2026, U.S. court-authorized seizures disrupted hard-coded infrastructure dependencies required for QScan and QTRouter communications and authentication, rendering the platforms inoperable at the time of the operation.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QScan scanned the internet for vulnerable Internet of Things devices and automatically infected them. Compromised devices were then enrolled into the QTRouter network.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
“QScan is harvesting more than vulnerability status—it’s harvesting operational secrets along the way,” including “unintentional disclosure of API keys and configuration details to scanners and crawlers.”
The QScan platform conducts reconnaissance against victim networks, including webpage scraping, TLS certificate collection, subdomain enumeration and penetration testing.
The QScan platform conducts reconnaissance against victim networks, including webpage scraping, TLS certificate collection, subdomain enumeration and penetration testing.
The QScan and QTRouter infrastructure was used “to hide activity and probe targets, including critical infrastructure.”
QScan est un outil de scan automatisé qui infecte des milliers d’appareils IoT à travers le monde.
“QScan searched for vulnerable systems and automatically compromised internet-connected devices.” The joint advisory stated that QScan processed more than two million scanning and penetration-testing tasks on a single day in 2024.
The QScan platform conducts reconnaissance against victim networks, including webpage scraping, TLS certificate collection, subdomain enumeration and penetration testing.
“The ‘mq-task’ server hosted RabbitMQ message queues, which provided scanning tasks to a pool of worker nodes primarily housed on leased servers located outside of China.”
“QScan scans and automatically infects thousands of IoT devices worldwide, and then adds them to the QTRouter network of QTFY-controlled devices.”
QScan est un outil de scan automatisé qui infecte des milliers d’appareils IoT à travers le monde, les intégrant au réseau QTRouter.
“Attackers were able to hijack large numbers of routers, gateways, and other connected edge devices and turn them into anonymous relays.”
QScan ... infecte des milliers d’appareils IoT à travers le monde, les intégrant au réseau QTRouter.
“QTFY actors developed branded products, including a vulnerability scanning and exploitation platform named ‘QScan’, an obfuscation network named ‘QTRouter’, and botnets of compromised Internet of Things (IoT) devices.”
“QScan searched for vulnerable systems and automatically compromised internet-connected devices.”
“The advisory specifically calls out unintentional disclosure of API keys and configuration details to scanners and crawlers.”
“QScan hunted down and infected internet-of-things devices around the world.”
QScan and QTRouter formed a "shared scanning and obfuscation layer" used by Chinese state-linked operators.
By routing their malicious internet traffic through IoT devices (compromised by QScan) local to their victims, these Chinese hackers can blend in with legitimate users and remain undetected when scanning and attacking critical infrastructure and other targets.
“The seized domains were hard-coded into QScan and QTRouter malware. The domains supported essential malware functions, including communications and authentication.”
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.”
The takedown “removed infrastructure adversaries were using to hide activity and probe targets,” while hijacked devices were “turn[ed] into anonymous relays.”
[The attackers] hid activity by routing traffic through a large botnet of compromised internet-connected devices.
“The setup let QTFY route its attacks through machines outside China, including ones planted near the networks it was targeting, so the traffic looked like it came from somewhere else entirely.”
142 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.