How China’s QTFY Used QScan/QTRouter Against US Infrastructure

The US Department of Justice announced the takedown of two hacking platforms — QScan and QTRouter — which, according to the agency, were used by the Chinese state-sponsored group QTFY to attack US critical infrastructure. The reported victims include NASA, the Federal Reserve System, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the US Senate. Domains hardcoded in the code of both platforms were seized under a court order, which reportedly led to their shutdown. Organizations using the products listed in the FBI advisory should immediately check their networks for indicators of compromise and ensure that patches for the exploited vulnerabilities are up to date.

Infrastructure architecture: from scanning to obfuscation

According to the FBI advisory, QTFY’s activity is attributed to the company Nanjing Xinjiuwei Network Technology Company. According to researchers from Lumen Black Lotus Labs, the infrastructure has presumably been operational since May 2018, and cooperation with the FBI on this case continued for about a year.

The QScan platform performs automated scanning and infection of vulnerable IoT devices worldwide, forming them into a botnet. Infected devices are incorporated into the QTRouter network — an obfuscation proxy network that combines compromised IoT devices, commercial proxy services, and rented VPS servers. The key purpose of QTRouter is to mask the real source of attacks: traffic appears to originate from points outside China, often geographically close to the target networks.

QTRouter runs on routers with custom OpenWrt firmware and uses the Clash tool to establish proxy connections. The system allows operators to view available nodes and build chains for multi-layer obfuscation, mixing malicious traffic with legitimate traffic.

Botnet management is carried out through three platforms: Proxy Platform Management, Proxy Pool Management System, and QTBotnet — the latter includes the command-and-control server, secondary management servers, and compromised devices. The command-and-control server can also launch DDoS attacks and execute commands on infected nodes.

According to Lumen, the distributed architecture additionally includes components called Fast Labyrinth (the operational layer with commercial proxy infrastructure, including the Fastlink service) and QTProxy (management of Fast Labyrinth operational nodes. The entire construct is described as an Operational Relay Network (ORB) — a decentralized mesh network that routes traffic through rotating IP addresses.

Attack cycle and exploited vulnerabilities

According to FBI materials, a typical QTFY attack cycle includes four stages: reconnaissance via QScan, obtaining initial access through exploitation of vulnerabilities, establishing persistence using remote access trojans, web shells, and legitimate credentials, and then accessing the target network through nearby compromised IoT devices via QTRouter.

The list of exploited vulnerabilities covers both zero-days and long-known flaws. All listed CVEs are confirmed in NVD, and most are included in the CISA KEV catalog:

• Ivanti CSA: CVE-2024-8190 (CVSS 7.2), CVE-2024-8963 (CVSS 9.1), CVE-2024-9380 (CVSS 7.2) — OS command injection and path traversal; Ivanti has confirmed chained exploitation of these vulnerabilities
• Fortinet SSL-VPN: CVE-2018-13379 — path traversal in FortiOS/FortiProxy
• Citrix ADC/Gateway: CVE-2019-19781 (CVSS 9.8) — directory traversal
• Microsoft Exchange Server: CVE-2021-26855 (CVSS 9.8) — remote code execution
• Apache Log4j: CVE-2021-44228 — JNDI injection in Log4j2 versions 2.0-beta9 through 2.15.0
• Atlassian Confluence: CVE-2023-22515 (CVSS 10.0 according to Atlassian) — access control bypass
• Check Point Quantum Gateway: CVE-2024-24919 (CVSS 8.6) — information disclosure
• CrushFTP: CVE-2025-31161 — authentication bypass in versions 10 before 10.8.4 and 11 before 11.3.1
• BeyondTrust Remote Support: CVE-2026-1731 (CVSS 9.8) — pre-authentication remote code execution
• Also mentioned are F5 BIG-IP (CVE-2020-5902) and Kentico CMS (CVE-2019-10068)

Scale and context of the threat

According to Lumen, QTFY’s targeting extended across the Western world, with a particular focus on academic and research communities. Reportedly, attacks up to June 2026 were directed, among other things, at the US electoral system. The group is believed to have participated in Chinese freelance broker networks for buying and selling exploits and access to compromised networks.

Lumen characterizes the situation as a high degree of industrialization of Chinese cyber operations: a shift from fragmented, ad hoc configurations to shared multi-tenant utility networks that enable complex campaigns with a high degree of anonymity, speed, and global reach. The use of legitimate paid subscriptions to commercial proxy services makes traditional static blocking insufficient.

Indicators of compromise

Domains associated with QTFY infrastructure:

• qt-proxy[.]org
• mq-task.qt-proxy[.]org (previously mq-task.qt-team[.]com)
• mq-result.qt-proxy[.]org (previously mq-result.qt-team[.]com)
• www.qtproxy[.]xyz
• securelink.qtproxy[.]xyz
• fastlink.ws

Recommendations

1. Review network logs for any connections to the listed domains and IP addresses associated with QTRouter/QTProxy infrastructure
2. Immediately apply patches for all listed CVEs — most of them are included in the CISA KEV catalog and are being actively exploited. Priority: CVE-2026-1731 (BeyondTrust), CVE-2025-31161 (CrushFTP), CVE-2024-24919 (Check Point), CVE-2023-22515 (Confluence)
3. Audit IoT devices on the network: routers with non-standard OpenWrt firmware, devices with anomalous outbound traffic to proxy services
4. Implement monitoring for anomalous use of commercial proxy services from the corporate network — static IP-based blocking is ineffective against rotating ORB infrastructure
5. Check for web shells, RATs, and illegitimate accounts, especially on perimeter devices from Ivanti CSA, Fortinet, Citrix, and Exchange

The seizure of domains hardcoded in the QScan and QTRouter code temporarily neutralizes this particular infrastructure; however, ORB-type distributed architecture allows it to be reconstituted on new domains. Organizations should focus not only on blocking known indicators but also on detecting behavioral patterns — anomalous proxy traffic from IoT devices, chained exploitation of perimeter vulnerabilities, and signs of lateral movement through compromised routers located in close proximity to the target network.