U.S. authorities have disrupted a China-linked cyber operation that used compromised internet-connected devices and proxy infrastructure to target sensitive government and critical infrastructure networks. In an official announcement from the U.S. Department of Justice, the DOJ and FBI said they seized domains supporting two hacking platforms, QScan and QTRouter, rendering them inoperable. The infrastructure had supported malicious activity targeting organizations including NASA, the Federal Reserve, the Justice Department and the U.S. Senate.
Court documents attribute the platforms to QTFY, also known as QT and QTCYBER, a group authorities say worked for China-based Nanjing Xinjiuwei Network Technology Company. The DOJ alleges that the company provided hacking services to customers including China’s Ministry of State Security and People’s Liberation Army. U.S. investigators have traced QTFY-linked malicious activity back to at least 2018, giving the operation a multi-year footprint across government and private-sector targets.
QScan and QTRouter Built a Distributed Attack Network
QScan was designed to scan for vulnerabilities and automatically compromise Internet-of-Things devices, which could then be incorporated into QTRouter. The DOJ described QTRouter as an obfuscation network combining compromised IoT hardware, commercial proxy devices and leased virtual private servers. That distributed structure allowed malicious traffic originating from China to appear as though it came from unrelated systems elsewhere, including locations closer to intended targets.
The National Security Agency said QTFY also used zero-day and previously disclosed vulnerabilities to gain access to networks and obtained legitimate credentials from compromised systems to maintain persistence. The NSA’s advisory broadens the threat picture beyond individual intrusions, describing an ecosystem of scanning, exploitation, botnet management and traffic concealment tools.
The domain seizures were particularly disruptive because the seized domains were hard-coded into QScan and QTRouter and required for functions including authentication and communication. By taking control of those dependencies, U.S. authorities were able to disable the platforms rather than simply block individual compromised devices. The government has also publicized reward mechanisms offering up to $10 million for information concerning foreign-government-directed malicious cyber activity.
Agencies Urge Defenders to Hunt for Residual Compromise
Disabling the command-and-control infrastructure does not determine what information may already have been accessed or stolen. Organizations previously targeted by QTFY still face the separate task of identifying persistent access, compromised credentials and other indicators left behind before the takedown.
The NSA, FBI and Cyber National Mission Force have urged organizations to apply current software and firmware updates, audit internet-facing applications, isolate critical systems from edge devices and search networks for published indicators of compromise. Those recommendations reflect the continuing risk posed by poorly secured IoT and edge devices, which can be repurposed as infrastructure for attacks against much more sensitive networks.
The operation follows earlier U.S. actions against China-linked botnets associated with Volt Typhoon, Flax Typhoon and Mustang Panda. QTFY’s disruption therefore fits into a broader strategy of dismantling the technical infrastructure used to conceal and sustain state-linked cyber operations, rather than relying exclusively on attribution and sanctions after intrusions occur.
