Minacce · 41 giorni fa
DOJ e FBI hanno sequestrato i domini di QScan e QTRouter, togliendo a QTFY una parte della piattaforma che da anni nascondeva le sue intrusioni dietro dispositivi IoT compromessi e proxy a noleggio. La misura interrompe un’infrastruttura usata contro agenzie federali statunitensi e settori critici, non solo un elenco di server.
Il punto non era soltanto il traffico malevolo. QScan cercava dispositivi IoT vulnerabili e li faceva entrare in una rete controllata dall’operatore; QTRouter aggiungeva altri nodi e faceva apparire le connessioni come se partissero da router, telecamere o reti locali qualsiasi. Questo poteva far sembrare un attacco cinese un accesso domestico o interno, e sporcare i tempi e l’attribuzione dell’incidente.
Per chi usa geolocalizzazione e source IP per capire se un accesso è remoto, locale o già dentro la rete, questa è la parte che resta vera dopo il sequestro: l’inganno funziona finché esiste una catena di dispositivi compromessi a coprire l’origine reale. Le IOC aiutano il hunting, ma la lettura della provenienza resta fragile quando l’avversario può cambiare faccia al traffico.
12 fonti che coprono questa storia
How China industrialized the infrastructure behind state hacking
The FBI’s takedown of QTFY exposes how China’s reliance on private cyber contractors gives state hackers scale and stealth.
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
DoJ corrected its QTFY statement, saying several U.S.
Chinese Hacker Group QTFY Uses Custom-Built Platforms to Target US Inf
The FBI advisory set out QTFY’s distributed hacking ecosystem, allowing it to exploit vulnerabilities at scale and obfuscate its activities
US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks
The operation focused on a group named QTFY, which offers hacking services to the Chinese government and others.
Federal authorities disrupt China-backed hacking operation targeting US critical infrastructure
Compromised IoT devices were used in a yearslong campaign against key sectors and federal agencies.
FBI disrupted a China-linked hacking network built on QScan and QTRouter, tools used against NASA, the Federal Reserve, and the U.S.
Beijing's botnets busted
Officials disrupt Chinese espionage operation that hit multiple federal agencies
The full hacking suite, seized by authorities, allowed Chinese government funded attackers to intrude highly sensitive networks undetected for more than eight years.
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI disrupted proxy infrastructure used in China-linked espionage to profile and steal data from U.S. critical infrastructure and other sectors
DOJ, FBI seize China-linked QScan and QTRouter platforms used to target US critical infrastructure, sensitive networks.
The Justice Department said that the domain seizures made the botnet and its command and control servers "inoperable," as the domains were hardcoded into the botnet's code and were critical for the botnet's communication and essential operations.
The Record from Recorded Future
US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate
The DOJ said it disrupted Chinese state-backed tools used to scan, infect and exploit IoT devices for attacks on federal agencies and multiple industries.
Part of the PlainSec briefing for 2026-09-03