Loading malware…
QTProxy is a China-nexus operational proxy-management component associated with the QTFY “Quartermaster” infrastructure model. It manages Fast Labyrinth operational nodes and enables downstream operators to select preconfigured relays or construct target-specific, multi-hop traffic paths. The system supports the routing and administration of proxy infrastructure composed of compromised Internet-of-Things devices, commercial proxy services, and leased virtual private servers, helping obscure the origin and apparent geographic source of operator traffic. QTProxy has been linked alongside QScan, QTRouter, and Fast Labyrinth to infrastructure supporting reconnaissance, proxy orchestration, routing, and access for cyber-espionage operations targeting government, defense, critical infrastructure, research, healthcare, energy, financial, and other sensitive sectors worldwide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“QTProxy managed operational nodes and allowed operators to configure routes toward selected targets.”
2 distinct techniques documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A component of the reported Quartermaster service model, associated with proxy orchestration and operator/customer access. The content does not provide further technical details.
A QTFY infrastructure component used to manage operational proxy nodes and configure relay routes to selected targets.
A proxy-management component for Fast Labyrinth that enables operators to manage relay nodes and establish preconfigured or bespoke traffic paths to targets.
The administrative proxy-node management system and control plane used to coordinate relay paths and traffic-forwarding rules for Fast Labyrinth.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.