Loading story…
US authorities disrupted QScan and QTRouter, two platforms allegedly operated by the China-linked QTFY group to scan for, compromise, and proxy traffic through internet-connected devices. The Department of Justice and FBI seized supporting domains and linked the operation to Nanjing Xinjiuwei Network Technology, whose alleged customers included China’s Ministry of State Security and the People’s Liberation Army. China denied involvement.
QScan was reportedly used for mass vulnerability scanning and automated exploitation, while QTRouter turned compromised devices into an obfuscation network for attacker traffic. A joint FBI, NSA, and Cyber National Mission Force advisory reported that QScan handled more than two million scanning and penetration-testing tasks in a single day; alleged targets included government agencies, defense contractors, energy, telecommunications, finance, and universities. Organizations should patch exposed edge devices, segment critical systems, and hunt for published indicators, as compromised devices and stolen credentials may still provide residual access after the seizures.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
A joint FBI, NSA, and Cyber National Mission Force advisory reported that QScan processed more than two million scanning and penetration-testing tasks in a single day in 2024.
China denied involvement in the alleged campaign and accused the United States of using cybersecurity concerns to discredit Chinese companies.
US officials alleged that QTFY operated through Nanjing Xinjiuwei Network Technology and that the company's customers included China’s Ministry of State Security and the People’s Liberation Army.
US authorities, including the Department of Justice and FBI, disrupted the QScan and QTRouter platforms by seizing supporting domains. Officials alleged the platforms were used by the Chinese state-sponsored QTFY group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and Department of Justice seized domains supporting the China-linked **QTFY** espionage group's QScan and QTRouter platforms after the infrastructure was linked to intrusions at NASA, the Federal Reserve, the Departments of Justice and Energy, and the U.S. Senate. Officials said the platforms supported follow-on attacks against sensitive networks and U.S. critical infrastructure, though they did not disclose the extent of access or data compromise at each victim. QTFY's technical infrastructure included the QScan reconnaissance and IoT-compromise tool, QTRouter hardware, QTProxy route management, and the Fast Labyrinth encrypted relay network. The operators combined compromised IoT devices, leased VPS systems, and premium nodes from the Chinese commercial proxy service `fastlink.ws` to rotate malicious traffic through consumer-proxy infrastructure and conceal its origin. Defenders should prioritize edge-device hardening and apply CISA and NCSC guidance on China-linked threats, as static IP or domain blocking alone is unlikely to stop the dynamically changing relay network.
Aug 31, 2026
A joint FBI, NSA and U.S. Cyber Command advisory attributed the China-linked **QTFY** hacking group to Nanjing Xinjiuwei Network Technology Co. (XJW), alleging the group has operated since at least 2018 to develop malware, trade exploits, run an obfuscation botnet, and target U.S. government and critical-infrastructure organizations. U.S. authorities assessed that XJW maintained links to China’s Ministry of State Security through business relationships and personnel networks that include former People’s Liberation Army members. In a May 2024 campaign, QTFY used its `QScan` tool to identify U.S. power and telecommunications targets and exploited **CVE-2024-24919** in internet-facing Check Point Quantum Gateway appliances. The operation reportedly exfiltrated data from more than 300 organizations globally, including U.S. defense contractors, financial institutions, and universities; operators retained access through remote-access trojans, web shells, and legitimate credentials. Reporting also identifies Bozhi Security Technology/Elextec Cybersecurity and Nanjing Lexbell Information Technology as firms with client, leadership, product, and contract ties suggestive of links to Chinese intelligence, public-security, and military bodies.
Sep 10, 2026
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026