Loading malware…
QTProxy is a China-nexus operational proxy-management component associated with the QTFY “Quartermaster” infrastructure model. It manages Fast Labyrinth operational nodes and enables downstream operators to select preconfigured relays or construct target-specific, multi-hop traffic paths. The system supports the routing and administration of proxy infrastructure composed of compromised Internet-of-Things devices, commercial proxy services, and leased virtual private servers, helping obscure the origin and apparent geographic source of operator traffic. QTProxy has been linked alongside QScan, QTRouter, and Fast Labyrinth to infrastructure supporting reconnaissance, proxy orchestration, routing, and access for cyber-espionage operations targeting government, defense, critical infrastructure, research, healthcare, energy, financial, and other sensitive sectors worldwide.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“QTProxy managed operational nodes and allowed operators to configure routes toward selected targets.”
2 distinct techniques documented for this family, organized by ATT&CK tactic.
QTFY’s QScan and QTRouter worked with compromised Internet-of-Things devices, commercial proxy-service devices, and leased virtual private servers. Lumen described ... proxy orchestration, operator or customer access, routing, and node management.
“Operators could select available nodes and chain them together, creating multiple layers between themselves and their targets.”
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.