Loading malware…
QTRouter is a botnet-backed proxy and traffic-obfuscation platform operated by QTFY, a China-linked cyber threat group attributed by U.S. authorities to Nanjing Xinjiuwei Network Technology Company. It combines compromised Internet-of-Things devices, commercial proxy services, and leased virtual private servers into multi-hop relay routes that conceal the origin of malicious intrusion traffic. Operators can route connections through infrastructure outside China or geographically near a target, blending malicious activity with ordinary proxy traffic and complicating detection and attribution.
QTRouter operates on routers running customized OpenWrt firmware and uses the Clash proxy framework to establish and chain connections. Its complementary QScan platform scans for vulnerable internet-connected devices, automatically compromises susceptible IoT systems, and enrolls them as QTRouter proxy nodes. QTRouter forms part of a broader infrastructure-service architecture that includes Fast Labyrinth relay infrastructure and QTProxy node management, supporting QTFY and other paying operators rather than a single intrusion campaign.
QTFY's services have supported operations targeting government, defense, telecommunications, energy, financial services, healthcare, higher education, and other critical-infrastructure sectors. U.S. authorities identified China's Ministry of State Security and People's Liberation Army among its customers. In August 2026, court-authorized seizures disrupted hard-coded infrastructure dependencies used for essential communications and authentication; the U.S. Department of Justice stated that this rendered QScan and QTRouter inoperable.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QTRouter combined infected IoT devices with commercial proxy services and leased virtual private servers. This setup allowed QTFY operators and other users to route malicious traffic through systems outside China.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The QScan and QTRouter infrastructure was used “to hide activity and probe targets, including critical infrastructure.”
QScan and QTRouter [were] scanning for vulnerable devices, infecting them, and turning them into proxy nodes.
QTRouter est un réseau d’obfuscation composé d’appareils IoT compromis, de proxies commerciaux et de serveurs privés virtuels (VPS) loués.
“QTRouter runs on compromised routers flashed with custom OpenWrt firmware,” while botnet platforms “aggregate compromised IoT devices” for proxy nodes and DDoS launch points.
QScan est un outil de scan automatisé qui infecte des milliers d’appareils IoT à travers le monde, les intégrant au réseau QTRouter.
“Attackers were able to hijack large numbers of routers, gateways, and other connected edge devices and turn them into anonymous relays.”
QScan ... infecte des milliers d’appareils IoT à travers le monde, les intégrant au réseau QTRouter.
“QTFY actors developed branded products, including a vulnerability scanning and exploitation platform named ‘QScan’, an obfuscation network named ‘QTRouter’, and botnets of compromised Internet of Things (IoT) devices.”
The hackers unsuccessfully attempted to gain access to NASA networks in August 2019 by targeting a virtual private network vulnerability.
QScan and QTRouter formed a "shared scanning and obfuscation layer" used by Chinese state-linked operators.
By routing their malicious internet traffic through IoT devices (compromised by QScan) local to their victims, these Chinese hackers can blend in with legitimate users and remain undetected when scanning and attacking critical infrastructure and other targets.
“The seized domains were hard-coded into QScan and QTRouter malware. The domains supported essential malware functions, including communications and authentication.”
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.”
The takedown “removed infrastructure adversaries were using to hide activity and probe targets,” while hijacked devices were “turn[ed] into anonymous relays.”
[The attackers] hid activity by routing traffic through a large botnet of compromised internet-connected devices.
QTRouter ... permet de masquer l’origine chinoise des intrusions en faisant apparaître le trafic malveillant comme provenant de machines locales aux réseaux ciblés.
The entire architecture underpins Fast Labyrinth, an encrypted relay network that blends malicious traffic with legitimate network activity.
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.