Loading malware…
QTRouter is a QTFY-operated traffic-obfuscation and proxy network used to conceal the origin of intrusion activity. It combines compromised Internet-of-Things devices, including routers running customized OpenWrt firmware, with commercial proxy services and leased virtual private servers. QTRouter uses the Clash proxy framework to establish and chain relay connections, enabling operators to route traffic through multiple intermediary nodes, including nodes geographically proximate to intended targets. QScan-compromised IoT devices were incorporated into QTRouter as proxy nodes. The platform supported QTFY, a China-linked threat group associated with Nanjing Xinjiuwei Network Technology Company, as well as other users of its infrastructure services. QTFY activity targeted government, defense, energy, water, communications, healthcare, financial, higher-education, and other critical-infrastructure organizations. U.S. authorities disrupted QTRouter in August 2026 by seizing hard-coded infrastructure required for its communications and authentication.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QTRouter is the obfuscation layer... It runs on compromised routers flashed with custom OpenWrt firmware... QTRouter nodes include commercial residential-proxy services... Alibaba Cloud infrastructure, and compromised consumer IoT devices.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
QTRouter est un réseau d’obfuscation composé d’appareils IoT compromis, de proxies commerciaux et de serveurs privés virtuels (VPS) loués.
“QTRouter runs on compromised routers flashed with custom OpenWrt firmware,” while botnet platforms “aggregate compromised IoT devices” for proxy nodes and DDoS launch points.
QScan est un outil de scan automatisé qui infecte des milliers d’appareils IoT à travers le monde, les intégrant au réseau QTRouter.
“Attackers were able to hijack large numbers of routers, gateways, and other connected edge devices and turn them into anonymous relays.”
QScan and QTRouter formed a "shared scanning and obfuscation layer" used by Chinese state-linked operators.
By routing their malicious internet traffic through IoT devices (compromised by QScan) local to their victims, these Chinese hackers can blend in with legitimate users and remain undetected when scanning and attacking critical infrastructure and other targets.
“The seized domains were hard-coded into QScan and QTRouter malware. The domains supported essential malware functions, including communications and authentication.”
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.”
The takedown “removed infrastructure adversaries were using to hide activity and probe targets,” while hijacked devices were “turn[ed] into anonymous relays.”
[The attackers] hid activity by routing traffic through a large botnet of compromised internet-connected devices.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A QTFY platform used for routing and proxy orchestration across compromised IoT devices, commercial proxy devices, and leased VPS infrastructure. Its hard-coded domains were essential to communications and authentication.
Obfuscation and proxy network using compromised IoT devices, commercial proxies, and rented VPS infrastructure to conceal the Chinese origin of intrusions by making malicious traffic appear to originate from systems local to target networks. Hard-coded domains were used for communications and authentication.
An attack-traffic obfuscation and proxy-chaining network that blends traffic from compromised routers and IoT devices with commercial residential proxies and cloud infrastructure, making QTFY activity resemble legitimate residential customer traffic.
China-linked malicious scanning and obfuscation platform used to identify targets, relay activity through compromised devices, and obscure the origin of operations targeting U.S. critical infrastructure and federal networks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.