Loading story…
The FBI and Department of Justice seized domains supporting the China-linked QTFY espionage group's QScan and QTRouter platforms after the infrastructure was linked to intrusions at NASA, the Federal Reserve, the Departments of Justice and Energy, and the U.S. Senate. Officials said the platforms supported follow-on attacks against sensitive networks and U.S. critical infrastructure, though they did not disclose the extent of access or data compromise at each victim.
QTFY's technical infrastructure included the QScan reconnaissance and IoT-compromise tool, QTRouter hardware, QTProxy route management, and the Fast Labyrinth encrypted relay network. The operators combined compromised IoT devices, leased VPS systems, and premium nodes from the Chinese commercial proxy service fastlink.ws to rotate malicious traffic through consumer-proxy infrastructure and conceal its origin. Defenders should prioritize edge-device hardening and apply CISA and NCSC guidance on China-linked threats, as static IP or domain blocking alone is unlikely to stop the dynamically changing relay network.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
The FBI stated that attacks attributed to the China-linked QTFY group targeted a U.S. election system as recently as June 2026.
In March 2026, QTFY scanned for vulnerabilities and unsuccessfully attempted to access the networks of the U.S. Senate and a U.S. hospital.
QTFY exploited CrushFTP vulnerability CVE-2025-31161 against a U.S. biotechnology company.
In May 2024, QTFY allegedly rapidly exploited a publicly disclosed vulnerability in Check Point security equipment. The activity reportedly stole server configuration settings and user-account information from more than 300 U.S. organizations.
Several months after its May 2024 Check Point activity, QTFY allegedly exploited a previously unknown Ivanti vulnerability. The exploitation provided access to three national laboratories, the National Institutes of Health, another HHS agency, and a U.S. security-device manufacturer.
According to Lumen, Chinese threat actors have increasingly used Operational Relay Box (ORB) networks in cyber operations since 2024 to relay and obscure malicious traffic.
The FBI investigated an attempted intrusion against NASA in August 2019 that sought to exploit CVE-2019-11510, a critical Ivanti Pulse Secure VPN vulnerability. The flaw could expose user credentials and permit unauthorized network access.
The FBI and NSA published a cybersecurity advisory containing indicators of compromise for QTFY. Their analysis associated QTFY malicious cyber activity with operations dating back to at least 2018.
The DOJ alleged that China-based Nanjing Xinjiuwei Network Technology Company operated the QScan and QTRouter platforms used by QTFY. The FBI said the company sold stolen data and hacking services to Chinese military and intelligence agencies.
The FBI and Department of Justice disrupted the China-linked infrastructure and seized domains hard-coded into QScan and QTRouter malware. The platforms used compromised IoT devices, commercial proxy nodes, and leased VPS infrastructure to conceal follow-on attacks and their origin.
After tracking the infrastructure for approximately a year, Lumen's Black Lotus Labs identified QScan, Fast Labyrinth, QTRouter, and QTProxy as components supporting reconnaissance, routing, and data theft against U.S. organizations. Lumen shared intelligence with U.S. government agencies and null-routed known infrastructure points.
U.S. officials said the Chinese state-sponsored QTFY group breached NASA, the Federal Reserve, the Department of Energy, the U.S. Senate, and the Department of Justice while targeting critical infrastructure and sensitive networks. Officials did not disclose the scope or nature of the compromises.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 444 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
25 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcecommunity.gurucul.com
Open sourcesecurityonline.info
Open sourceinfosecurity-magazine.com
Open sourcejustice.gov
Open sourcelumen.com
Open sourceic3.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026
U.S. authorities and private-sector researchers said the China-linked threat actor **Flax Typhoon** operated a sprawling IoT botnet known as **Raptor Train** to conceal intrusions into critical infrastructure networks. Black Lotus Labs said the botnet had been active since 2020, at one point exceeding 60,000 live nodes and compromising more than 200,000 routers, NAS devices, IP cameras, and other internet-exposed systems. The operation used a multi-tier architecture and a custom Mirai-derived implant called `Nosedive`, which enabled remote command execution, file transfer, and retained **DDoS** capability while using in-memory execution and anti-forensics techniques. Researchers linked the activity to targeting in the United States and Taiwan across government, military, telecommunications, higher education, defense industrial base, and IT sectors, alongside scanning and likely exploitation attempts against **Atlassian Confluence** and **Ivanti Connect Secure** appliances. The **FBI** and Department of Justice said they disrupted the botnet in a court-authorized operation that removed malware from infected routers, and officials later said the action effectively dismantled infrastructure used by Chinese operators to hide follow-on hacking. Subsequent reporting said the botnet exploited dozens of vulnerabilities across edge and IoT products, with VulnCheck identifying **66 actively targeted CVEs** tied to the campaign, far more than were listed in CISA’s Known Exploited Vulnerabilities catalog. Additional reporting also pointed to corporate links around **Integrity Technology**, described as connected to Flax Typhoon and tied through competitive, partner, and client relationships to **i-SOON**, adding to the picture of a broader Chinese intrusion ecosystem supporting espionage and potential disruptive operations.
Jun 29, 2026
U.S. authorities disrupted the **911 S5** residential proxy service, a botnet-backed platform that allegedly compromised millions of Windows devices and sold their IP addresses as proxies to cybercriminals. The FBI and international partners seized infrastructure tied to the service, while prosecutors charged and arrested the alleged administrator, identified as Chinese national YunHe Wang. According to investigators, the service enabled fraud, bomb threats, child exploitation, harassment, and large-scale financial crime by letting users route malicious traffic through unsuspecting victims’ home internet connections. The FBI’s IC3 warned that infected devices were commonly enrolled through VPN or pirated software bundles and urged users to scan for malware, remove suspicious applications, and reinstall operating systems if needed. The operation follows a broader U.S. strategy of court-authorized botnet disruption previously used against state-linked infrastructure, including the 2018 takedown of the **APT28** router botnet, underscoring continued law-enforcement use of technical and legal measures to seize command infrastructure and cut off criminal proxy networks.
Jul 12, 2026