Loading malware…
QTBotnet is an IoT botnet-management platform operated by the China-linked QTFY threat group, which has been associated with Nanjing Xinjiuwei Network Technology. It uses a hierarchical architecture comprising a primary controller, secondary control servers, and compromised devices. Operators can manage and view botnet nodes, execute arbitrary commands on infected IoT devices, and launch distributed denial-of-service attacks. QTBotnet forms part of QTFY's broader infrastructure for aggregating and managing compromised devices, alongside proxy-management systems used to support traffic obfuscation and intrusion operations. QTFY has targeted government, critical infrastructure, defense, telecommunications, energy, financial services, healthcare, water, and higher-education organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QTBotnet’s control server can launch DDoS attacks on command, view and import nodes, and run arbitrary commands on compromised devices.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A botnet platform within QTFY's infrastructure that manages compromised IoT nodes, supports arbitrary command execution on those nodes, and can launch distributed denial-of-service attacks.
A botnet component that enables operators to control infected systems, execute commands, and conduct distributed denial-of-service attacks.
A botnet-control platform used to manage compromised devices through primary and secondary control servers. Its controller can execute commands on infected nodes and launch DDoS attacks.
A multi-tier botnet platform comprising a main controller, secondary control servers, and compromised devices. It supports node management, command execution on compromised IoT devices, and DDoS attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.