FBI Disrupts China-Linked QTFY Botnet Infrastructure Targeting US Networks

QTFY is a China-linked cyber contractor whose QScan and QTRouter platforms formed an obfuscation botnet used to mask the origin of intrusions into U.S. networks. The DoJ said on Wednesday it obtained court authorization to seize domains that both tools depended on, including qt-proxy[.]org, mq-task.qt-proxy[.]org, mq-result.qt-proxy[.]org, and the QTRouter administration servers www.qtproxy[.]xyz and securelink.qtproxy[.]xyz. Because these addresses were hard-coded into the software, the seizure caused both platforms to stop functioning.

FBI Director Kash Patel said the bureau disrupted "a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure," adding that the tools let PRC cyber actors hide the origin of their attacks. The DoJ attributed the activity to Nanjing Xinjiuwei Network Technology Company, describing it as a contractor whose customers include China's Ministry of State Security and the People's Liberation Army.

According to the DoJ, confirmed QTFY victims include NASA, the Federal Reserve, the Department of Energy, the Department of Justice itself, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. Damon Rouse, a researcher at Lumen's Black Lotus Labs who has tracked the group for roughly 18 months, told The Hacker News the operation has run since May 2018 and has hit targets "throughout the western world and beyond, especially with regard to academia."

Lumen said QTFY favors research communities "given the collaborative nature of advanced science," pointing to a pattern of academic and scientific-sector targeting alongside government systems. The company also told The Hacker News that an attack as recent as June 2026 hit a U.S. election system, indicating the infrastructure remained in active use up to the takedown.

QScan is the reconnaissance and infection tool: it scans and automatically compromises vulnerable IoT devices worldwide, feeding them into the QTRouter network as proxy nodes, per the FBI. QTRouter then combines those hijacked devices with commercial proxy service subscriptions and leased virtual private servers, using the Clash proxy tool to chain nodes together. The FBI said this design lets QTFY-affiliated actors "blend in with legitimate users when targeting victim organizations," since traffic passes through IP addresses associated with real consumer or business connections.

• QTBotnet: a controller server plus secondary control servers that manage compromised devices and can launch DDoS attacks or run commands remotely.
• Fast Labyrinth: an operational layer folding commercial proxy service Fastlink (fastlink.ws) into an encrypted relay alongside QTRouter.
• QTProxy: manages Fast Labyrinth nodes, letting operators use preset relays or build custom paths to targets.

The FBI outlined a repeatable attack cycle: QScan conducts reconnaissance, operators exploit zero-day flaws in Ivanti CSA appliances (CVE-2024-8190, CVE-2024-8963, CVE-2024-9380) alongside a long list of N-day bugs, then establish persistence with remote access trojans, web shells, or stolen credentials before routing final access through QTRouter's compromised IoT layer. The N-day list spans CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in Microsoft Exchange, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 in Atlassian Confluence, CVE-2024-24919 in Check Point Quantum Gateway, CVE-2025-31161 in CrushFTP, and CVE-2026-1731 in BeyondTrust Remote Support.

Lumen described the wider setup as an operational relay box, or ORB network: a decentralized mesh of infected IoT devices and leased servers that routes traffic through rotating IPs to defeat blocklists and geolocation-based rules. "Because these transit loops are procured via legitimate paid subscriptions to commercial proxy services, traditional static blocks are no longer sufficient to stop the threat," Lumen said.

Lumen frames QTFY as evidence of growing industrialization in China-nexus cyber operations. Rather than each operator building bespoke infrastructure, groups increasingly rent access to shared, multi-tenant utility networks, a model that lets state-sponsored actors run complex campaigns with more anonymity, speed, and global reach than fragmented, ad hoc setups allow, per Lumen's statement to The Hacker News.

The FBI also said Nanjing operates as an enabling company with business ties to larger China-based cyber firms specializing in critical infrastructure security, and that it draws on contacts held by former PLA members to win contracts tied to critical infrastructure targeting. QTFY actors are also alleged to have traded exploits and network access inside China-based freelance hacking-broker networks.

Seizing hard-coded domains stopped QScan and QTRouter from functioning, but it does not retroactively patch the edge appliances QTFY exploited for initial access, nor does it reclaim every hijacked IoT device already folded into the botnet. Organizations running Ivanti CSA, Citrix ADC, F5 BIG-IP, CrushFTP, or BeyondTrust Remote Support should confirm those systems are on patched versions and review logs for the exploitation patterns the FBI described.

Because QTRouter blended malicious traffic with legitimate commercial proxy subscriptions and compromised consumer devices, defenders should treat static IP blocklists as insufficient on their own and instead watch for behavioral anomalies tied to proxy chaining and Clash-based connections, consistent with Lumen's own guidance on the ORB model.

The FBI-led seizure disabled QScan and QTRouter by taking down domains hard-coded into both platforms, cutting off a proxy and botnet network that Chinese state-linked actors used to mask intrusions into U.S. federal and critical-infrastructure networks.

Security: The takedown removes shared attacker infrastructure but does not patch the underlying vulnerabilities QTFY exploited for initial access, so organizations running unpatched instances of the named products remain exposed to reinfection or use by other actors.

Privacy: Victims listed by the DoJ, including NASA, the Federal Reserve, and the U.S. Senate, faced potential data theft during intrusions that predate the disruption, though the extent of data taken has not been detailed publicly.

The DoJ and FBI seized domains that disabled QScan and QTRouter, dismantling obfuscation infrastructure that China-linked group QTFY used to hide intrusions into NASA, the Federal Reserve, and other U.S. organizations since 2018.