Loading malware…
Fast Labyrinth is an encrypted relay network within the QTFY “Quartermaster” infrastructure, a China-nexus operational enablement ecosystem associated with support for downstream cyber-espionage operators. It incorporates selected commercial proxy-service egress nodes with QTRouter access devices and QTProxy node-management infrastructure to create preconfigured or target-specific multi-hop traffic paths. The network is intended to obscure traffic to and from targeted entities, blend activity into ordinary consumer proxy traffic, and provide rotating relay capacity. Fast Labyrinth activity has been associated with targeting of government, defense, critical-infrastructure, judicial, research, healthcare, energy, financial, and enterprise environments internationally. Observed activity overlapped with QScan reconnaissance against the same targets, consistent with a workflow in which reconnaissance is followed by routed operator access. Fast Labyrinth is infrastructure rather than a standalone malware family.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Fast Labyrinth incorporated commercial proxy infrastructure into encrypted relay paths.”
5 distinct techniques documented for this family, organized by ATT&CK tactic.
“Fast Labyrinth traffic shows a focus on exposed development perimeters, unpatched cloud storage and credential theft.”
“Once a potential target interface was confirmed, the operator transitioned from broad probing to attempted exploitation,” targeting exposed development perimeters and unpatched cloud storage.
The proxy mesh was used in sessions intended to “harvest proprietary data” from systems previously identified by QScan.
“Compromised devices identified through QScan were subsequently used by QTRouter as proxy nodes. The network combined hacked IoT devices with commercial proxy services and leased virtual private servers.”
“Operators could select available nodes and chain them together, creating multiple layers between themselves and their targets.”
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.