Loading malware…
QTBotnet is an IoT botnet-management platform operated by the China-linked QTFY threat group, which has been associated with Nanjing Xinjiuwei Network Technology. It uses a hierarchical architecture comprising a primary controller, secondary control servers, and compromised devices. Operators can manage and view botnet nodes, execute arbitrary commands on infected IoT devices, and launch distributed denial-of-service attacks. QTBotnet forms part of QTFY's broader infrastructure for aggregating and managing compromised devices, alongside proxy-management systems used to support traffic obfuscation and intrusion operations. QTFY has targeted government, critical infrastructure, defense, telecommunications, energy, financial services, healthcare, water, and higher-education organizations.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QTBotnet’s control server can launch DDoS attacks on command, view and import nodes, and run arbitrary commands on compromised devices.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
“QTRouter runs on compromised routers flashed with custom OpenWrt firmware,” while botnet platforms “aggregate compromised IoT devices” for proxy nodes and DDoS launch points.
“QTFY actors developed branded products, including a vulnerability scanning and exploitation platform named ‘QScan’, an obfuscation network named ‘QTRouter’, and botnets of compromised Internet of Things (IoT) devices.”
“QTRouter is an obfuscation network built on compromised routers, commercial proxy services, and hijacked Internet of Things (IoT) devices, allowing the actors to blend malicious traffic with legitimate user activity.”
“QTBotnet’s control server can launch DDoS attacks on command.”
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.