Loading story…
A joint FBI, NSA and U.S. Cyber Command advisory attributed the China-linked QTFY hacking group to Nanjing Xinjiuwei Network Technology Co. (XJW), alleging the group has operated since at least 2018 to develop malware, trade exploits, run an obfuscation botnet, and target U.S. government and critical-infrastructure organizations. U.S. authorities assessed that XJW maintained links to China’s Ministry of State Security through business relationships and personnel networks that include former People’s Liberation Army members.
In a May 2024 campaign, QTFY used its QScan tool to identify U.S. power and telecommunications targets and exploited CVE-2024-24919 in internet-facing Check Point Quantum Gateway appliances. The operation reportedly exfiltrated data from more than 300 organizations globally, including U.S. defense contractors, financial institutions, and universities; operators retained access through remote-access trojans, web shells, and legitimate credentials. Reporting also identifies Bozhi Security Technology/Elextec Cybersecurity and Nanjing Lexbell Information Technology as firms with client, leadership, product, and contract ties suggestive of links to Chinese intelligence, public-security, and military bodies.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The FBI, NSA, and U.S. Cyber Command Cyber National Mission Force issued a joint advisory attributing QTFY to Nanjing Xinjiuwei Network Technology Co. The advisory assessed links between XJW and China’s Ministry of State Security, reported its relationships with firms including ELEX and Lexbell, and described QTFY targeting of U.S. government and critical-infrastructure organizations.
QTFY used its QScan tool to target U.S. power and telecommunications companies and exploited CVE-2024-24919 in Check Point Quantum Gateway appliances. The campaign reportedly exfiltrated data from more than 300 organizations globally, including U.S. defense contractors, financial institutions, and universities.
The joint U.S. advisory assessed that the China-linked QTFY hacking group had been active since at least 2018, developing malicious tools, trading malware and exploits, and maintaining an obfuscation botnet.
A court-authorized U.S. Department of Justice action seized hard-coded domains used by QTFY's QScan and QTRouter platforms for essential communications and authentication. The DOJ reported that the seizure rendered both platforms inoperable.
Referenced analysis reported that ELEX had intelligence, public-security, and PLA-affiliated customers and capabilities including cyber-range, vulnerability-scanning, and influence-operation support. It also reported that Lexbell had military-use products, PLA-linked leadership and use, and contracts involving the PLA-affiliated National University of Defense Technology.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
blog.alphahunt.io
Open sourcemalware.news
Open sourcenattothoughts.com
Open sourceblackfog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and Department of Justice seized domains supporting the China-linked **QTFY** espionage group's QScan and QTRouter platforms after the infrastructure was linked to intrusions at NASA, the Federal Reserve, the Departments of Justice and Energy, and the U.S. Senate. Officials said the platforms supported follow-on attacks against sensitive networks and U.S. critical infrastructure, though they did not disclose the extent of access or data compromise at each victim. QTFY's technical infrastructure included the QScan reconnaissance and IoT-compromise tool, QTRouter hardware, QTProxy route management, and the Fast Labyrinth encrypted relay network. The operators combined compromised IoT devices, leased VPS systems, and premium nodes from the Chinese commercial proxy service `fastlink.ws` to rotate malicious traffic through consumer-proxy infrastructure and conceal its origin. Defenders should prioritize edge-device hardening and apply CISA and NCSC guidance on China-linked threats, as static IP or domain blocking alone is unlikely to stop the dynamically changing relay network.
Aug 31, 2026
US authorities disrupted **QScan** and **QTRouter**, two platforms allegedly operated by the China-linked QTFY group to scan for, compromise, and proxy traffic through internet-connected devices. The Department of Justice and FBI seized supporting domains and linked the operation to Nanjing Xinjiuwei Network Technology, whose alleged customers included China’s Ministry of State Security and the People’s Liberation Army. China denied involvement. QScan was reportedly used for mass vulnerability scanning and automated exploitation, while QTRouter turned compromised devices into an obfuscation network for attacker traffic. A joint FBI, NSA, and Cyber National Mission Force advisory reported that QScan handled more than two million scanning and penetration-testing tasks in a single day; alleged targets included government agencies, defense contractors, energy, telecommunications, finance, and universities. Organizations should patch exposed edge devices, segment critical systems, and hunt for published indicators, as compromised devices and stolen credentials may still provide residual access after the seizures.
Sep 15, 2026
The China-linked **JDY botnet** has grown from roughly 650 devices in early 2024 to more than **1,500 compromised SOHO and IoT systems**, according to Lumen Black Lotus Labs, and is being used primarily for **cyber reconnaissance** rather than disruptive attacks. Researchers said the infrastructure, previously tied to a cluster within **KV-botnet** and associated with Chinese state-backed activity including support for **Volt Typhoon**, performs scanning, service fingerprinting, banner grabbing, TLS certificate collection, and vulnerability-focused discovery. Many infected nodes are located in the **United States and Brazil**, and the activity shows a strong emphasis on **U.S. military and related networks**. The operators reportedly move quickly after new vulnerabilities are disclosed, with researchers observing targeting tied to **`CVE-2026-35616`** soon after Fortinet revealed the **FortiClient EMS** flaw, indicating reconnaissance data is being gathered for possible follow-on exploitation. JDY uses **Tor hidden services** for command-and-control, can leverage the **Platypus** reverse-shell and host-management framework, and adjusts its scanning techniques based on device privileges, including high-speed raw SYN scanning when elevated access is available. The report warns that compromised edge devices from multiple vendors are being folded into the botnet and urges organizations to patch routers, firewalls, and IoT devices, disable unnecessary internet-exposed administration, restrict remote management, replace default credentials, and watch for unusual outbound scanning.
Aug 14, 2026