U.S. authorities have issued a stark warning about China-linked hacking group QTFY, detailing a custom-built, distributed cyber ecosystem used to compromise military networks and critical infrastructure, even as court-authorized seizures disrupt part of its tooling.[1][2][9] A joint cybersecurity advisory from the FBI, NSA and Cyber National Mission Force describes QTFY—also known as QT and QTCYBER—as operating malicious platforms that enable large-scale exploitation of vulnerabilities while obscuring the origin of attacks.[1][3] The group’s infrastructure has been tied to intrusions at high-profile U.S. government entities and sensitive networks in both the public and private sectors.[5][7][9]
According to the advisory and related Justice Department filings, QTFY’s operations are anchored around complementary platforms dubbed QScan and QTRouter, which investigators say were designed to work together to identify weaknesses and route malicious traffic through layers of proxies.[1][2][4][9] QScan functions as a reconnaissance and vulnerability-scanning tool focused on internet-facing systems, while QTRouter acts as an obfuscation network to mask command-and-control traffic and hide attacker infrastructure behind compromised routers and IoT devices.[2][7][9] Additional components referenced in technical reporting include QTProxy, used to manage routes through the network, and the “Fast Labyrinth” encrypted relay system, which further complicates attribution by bouncing traffic through chains of relays.[7]
Officials say QTFY has been active since at least 2018, trading malware and exploit code within freelance hacking networks and systematically building what amounts to an obfuscation botnet to support follow-on intrusions.[1][3][7] The group has been linked to Nanjing Xinjiuwei Network Technology Company, a Chinese contractor that reportedly sells services to both the Ministry of State Security and the People’s Liberation Army, reinforcing assessments that QTFY operates with state backing.[5][8][9] Investigators attribute to QTFY targeting campaigns against a wide range of U.S. organizations, including telecommunications providers, higher education institutions, hospitals, power companies, and defense contractors, as well as federal agencies such as NASA, the Department of Justice, the Department of Energy, the National Institutes of Health, the Federal Reserve and the U.S. Senate.[3][5][9]
Technical reporting on past intrusions indicates QTFY has repeatedly capitalized on publicly disclosed, high-impact vulnerabilities, in line with broader Chinese state-sponsored tradecraft documented by U.S. cyber agencies.[7][11][13] In one 2019 investigation, the FBI linked an attempted intrusion against NASA to exploitation of CVE-2019-11510, a critical Ivanti Pulse Secure VPN flaw that allowed remote attackers to access sensitive configuration data and session information.[7] More recently, QTFY allegedly moved quickly to weaponize a vulnerability in Check Point security equipment shortly after it became public in May 2024, underscoring the group’s ability to fold freshly disclosed bugs into its distributed attack pipeline.[7][12] These patterns mirror joint advisories that warn Chinese actors are systematically scanning for and exploiting widely known CVEs across unpatched infrastructure.[11][12][13]
The Justice Department and FBI say they have now seized several domains tied to QScan and QTRouter, aiming to cut off QTFY’s access to key parts of its attack infrastructure and reduce the group’s ability to route traffic through compromised devices.[2][4][9] While the operation is expected to degrade the effectiveness of QTFY’s platforms, officials caution that the group may stand up replacement infrastructure or attempt to reconstitute its distributed systems using new domains and hosting providers.[1][2][7] The joint advisory urges potential targets not to assume the threat has been neutralized and to continue monitoring for indicators of compromise associated with the seized platforms and related tooling.[1][3][9]
Network defenders are advised to review the detailed tactics, techniques and procedures (TTPs) and indicators of compromise (IOCs) published in the QTFY advisory, paying particular attention to unusual router activity, unexplained VPN connections and scanning patterns characteristic of QScan.[1][3] Agencies recommend applying security updates for internet-exposed systems, hardening remote access services, enforcing strong authentication, and segmenting critical networks to limit the blast radius of successful exploitation.[1][12][13] Organizations operating in sectors already singled out as targets—telecom, energy, healthcare, higher education and government—are urged to conduct proactive threat hunting, validate logging and telemetry coverage, and be prepared for further campaigns that may leverage new infrastructure but reuse QTFY’s established exploitation techniques.[1][3][5]
References
- NSA Joins FBI in Issuing Warning about Chinese Hacking Group …
- Justice Department and FBI Seize Platforms Operated and Used by …
- The @FBI, @NSAGov and @US_CYBERCOM have issued a Joint …
- Justice Department and FBI Seize Platforms Operated and …
- FBI says Chinese hacking group targeted US government agencies …
- FBI Disrupts QTFY Proxy Network Used to Breach U.S. Federal …
- INDUSTRY ARTICLES – Cubex Group
- US Seizes China-Linked Hacking Domains Amid Security Risks
- [PDF] Chinese State-Sponsored Actors Exploit Publicly Known …
- Countering Chinese State-Sponsored Actors Compromise …
- [PDF] Top CVEs Actively Exploited By People’s Republic of China State …
