Threats · 41 days ago
DOJ and FBI seized domains tied to QScan and QTRouter, the China-linked platforms QTFY used to scan, infect, and route attacks against U.S. federal agencies and critical infrastructure. The disruption also hit the layer that made those operations look like they came from ordinary IoT devices, leased proxies, or even local networks.
QScan hunted for vulnerable internet-connected devices and pulled them into a botnet; QTRouter then used that mix of infected routers, cameras, and proxy infrastructure to hide where the traffic really came from. In practice, that means a victim could misread a foreign intrusion as domestic, or mistake a remote operator for something inside its own network.
For defenders that lean on source IP or geolocation to sort internal from external activity, the lesson is that those signals can be staged. The takedown removes one masking service, but it does not change the fact that compromised devices and proxy chains can still distort attribution and forensic timelines elsewhere.
12 sources covering this story
How China industrialized the infrastructure behind state hacking
The FBI’s takedown of QTFY exposes how China’s reliance on private cyber contractors gives state hackers scale and stealth.
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
DoJ corrected its QTFY statement, saying several U.S.
Chinese Hacker Group QTFY Uses Custom-Built Platforms to Target US Inf
The FBI advisory set out QTFY’s distributed hacking ecosystem, allowing it to exploit vulnerabilities at scale and obfuscate its activities
US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks
The operation focused on a group named QTFY, which offers hacking services to the Chinese government and others.
Federal authorities disrupt China-backed hacking operation targeting US critical infrastructure
Compromised IoT devices were used in a yearslong campaign against key sectors and federal agencies.
FBI disrupted a China-linked hacking network built on QScan and QTRouter, tools used against NASA, the Federal Reserve, and the U.S.
Beijing's botnets busted
Officials disrupt Chinese espionage operation that hit multiple federal agencies
The full hacking suite, seized by authorities, allowed Chinese government funded attackers to intrude highly sensitive networks undetected for more than eight years.
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI disrupted proxy infrastructure used in China-linked espionage to profile and steal data from U.S. critical infrastructure and other sectors
DOJ, FBI seize China-linked QScan and QTRouter platforms used to target US critical infrastructure, sensitive networks.
The Justice Department said that the domain seizures made the botnet and its command and control servers "inoperable," as the domains were hardcoded into the botnet's code and were critical for the botnet's communication and essential operations.
The Record from Recorded Future
US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate
The DOJ said it disrupted Chinese state-backed tools used to scan, infect and exploit IoT devices for attacks on federal agencies and multiple industries.
Part of the PlainSec briefing for 2026-09-03