The FBI and U.S. Department of Justice have seized the infrastructure behind two China-linked hacking platforms that were used to compromise and conceal attacks against NASA, the Federal Reserve, the U.S. Senate, and other sensitive U.S. networks.

The platforms, known as QScan and QTRouter, were operated by a China-linked hacking group identified by U.S. authorities as QTFY. According to court documents, QTFY operated within a broader ecosystem of hackers-for-hire and provided services to Chinese intelligence and military customers.

The FBI's operation did not simply take down a website. Investigators seized domains that the malware depended on for critical communication and authentication functions, effectively rendering the platforms inoperable.

And the infrastructure uncovered by investigators reveals something more concerning: the attackers were deliberately building a global network of compromised devices to make attacks appear as if they were originating from ordinary systems around the world.

---

What Did the FBI Shut Down?

On August 26, 2026, the U.S. Department of Justice announced court-authorized seizures targeting two complementary hacking platforms:

• QScan
• QTRouter

U.S. authorities attribute the platforms to QTFY, a China-linked cyber threat group that has operated since at least 2018.

According to the DOJ, QTFY was associated with Nanjing Xinjiuwei Network Technology Company, a China-based company that allegedly provided hacking services and stolen data to Chinese government customers, including the Ministry of State Security (MSS) and the People's Liberation Army (PLA).

The FBI and DOJ seized multiple domains used by the platforms.

Those domains were not merely web pages used for administration. They were hard-coded into QScan and QTRouter malware and were required for important functions such as communication and authentication.

Once the domains were seized, the platforms could no longer perform those essential functions.

That effectively pulled the plug on the operation's infrastructure.

---

QScan: Finding and Infecting Vulnerable Devices

One of the most important components was QScan.

Rather than immediately attacking a high-value organization directly, QScan was designed to help the operators find vulnerable internet-connected systems.

According to U.S. authorities, QScan could scan the internet for vulnerable Internet of Things (IoT) devices and automatically compromise them.

That included devices such as:

• Home and small-office routers
• Security cameras
• Other internet-connected equipment
• Vulnerable network infrastructure

Once compromised, these systems could become part of the attacker's infrastructure.

This creates a major problem for defenders.

A malicious connection doesn't necessarily have to travel directly from the attacker's actual infrastructure to the victim.

Instead, the attacker can route traffic through compromised systems belonging to completely unrelated people and organizations.

The victim sees traffic coming from an innocent-looking device.

The attacker stays hidden behind it.

---

QTRouter: Turning Compromised Devices Into Cover

QScan and QTRouter served different purposes but worked together. QScan helped identify and compromise vulnerable systems. QTRouter used those compromised systems as an obfuscation network.

The DOJ described QTRouter as a network consisting of compromised IoT devices, commercial proxy services and leased virtual private servers.

The result was effectively a distributed proxy infrastructure that could conceal the true origin of malicious traffic. The FBI says traffic could be routed through ordinary devices in more than 130 countries.

That means an attack against a U.S. organization could appear to originate from a device thousands of miles away — or potentially from a compromised system geographically close to the victim.

As FBI Cyber Division Assistant Director Brett Leatherman explained, the infrastructure could make attacks appear to originate from everyday devices rather than from China.

This is more than traditional botnet abuse. It becomes an attribution problem. Blocking traffic based solely on geographic origin becomes far less effective when malicious traffic is constantly being routed through compromised infrastructure distributed across the globe.

---

NASA Was Among the Targets

The scale of the targeting is one of the most significant parts of the investigation. According to the DOJ, QTFY intrusion activity affected or targeted organizations including:

• NASA
• Federal Reserve
• U.S. Department of Energy
• U.S. Department of Justice
• Department of Health and Human Services
• National Institutes of Health
• U.S. Senate

The group also targeted organizations across critical sectors, including telecommunications, defense, government and higher education.

The campaign therefore wasn't focused on a single agency or industry. It represented a broad intelligence-collection operation against government and critical infrastructure targets.

---

🏭 The Targeting Went Beyond Government

QTFY's activity was not limited to government networks. U.S. authorities say the group targeted organizations across multiple sectors, including:

Defense Industrial Base

Defense contractors are particularly valuable targets because they can hold information relating to military technology, contracts, research and national-security programs.

Telecommunications

Telecom networks provide access to communications infrastructure and can potentially expose valuable metadata and information about individuals and organizations.

Energy and Critical Infrastructure

Power and energy organizations are strategically important because compromising them can provide intelligence about critical infrastructure and operational systems.

Healthcare

Hospitals and healthcare organizations can contain sensitive personal, operational and financial information while also operating complex, internet-connected environments.

Higher Education

Universities frequently conduct advanced research and maintain large networks with thousands of users and devices, making them attractive intelligence targets.

The FBI described QTFY as having used software vulnerabilities for nearly a decade to launch attacks against U.S. government agencies, power companies, telecommunications organizations and major hospitals.

---

Exploiting Zero-Days and Known Vulnerabilities

The operation also demonstrates why vulnerability management remains one of the most important defensive priorities.

According to the joint cybersecurity advisory released by the FBI, NSA and Cyber National Mission Force, QTFY has exploited both zero-day and N-day vulnerabilities.

A zero-day vulnerability is a flaw that defenders may not yet have a patch for.

An N-day vulnerability is different: the vulnerability is already known and may have a patch available, but vulnerable systems remain exposed because organizations have not updated them.

That distinction matters.

Attackers don't always need an unknown vulnerability.

A publicly known vulnerability can remain extremely valuable if thousands of organizations fail to patch it.

The advisory says QTFY also obtained legitimate credentials from compromised systems to maintain persistence after gaining initial access.

So the operation wasn't simply:

Scan → exploit → leave.

It could involve:

Reconnaissance → exploitation → credential theft → persistence → lateral activity → data collection.

---

🕵️ A Cybercrime-as-a-Service Model

One of the more interesting aspects of the case is how QTFY allegedly operated.

The FBI describes the group as functioning within a broader ecosystem involving hackers-for-hire, freelance exploit developers and Chinese government customers.

The group allegedly developed and sold hacking capabilities rather than relying exclusively on a conventional government cyber unit.

That model creates an important layer of separation.

Instead of every operation being directly conducted by government personnel, specialized private-sector or freelance actors can develop infrastructure, malware and exploits that can then be used by government customers.

The NSA says QTFY developed malicious tooling, traded malware and exploits through freelance hacking networks, and participated in malicious cyber contracting and subcontracting marketplaces.

This represents a broader trend in the cyber threat landscape:

Government-backed cyber operations increasingly don't have to look like traditional government operations.

They can resemble commercial services.

Infrastructure can be rented.

Exploits can be acquired.

Compromised devices can be assembled into proxy networks.

And specialized capabilities can be outsourced.

---

Why the QTFY Infrastructure Was So Difficult to Detect

Traditional defenders often look for obvious signs of malicious infrastructure.

For example:

“Is this IP address associated with an attacker?”

But QTRouter complicates that question.

If malicious traffic is routed through:

• A compromised home router
• A hacked security camera
• A commercial proxy
• A leased VPS
• Another compromised IoT device

then the IP address observed by the victim may belong to an entirely legitimate network.

The owner of that device may have no idea it has been compromised.

This allows the attacker to effectively borrow the reputation and geographic location of innocent infrastructure.

It's similar to someone committing a crime while continuously changing vehicles — except the vehicles belong to thousands of unrelated people.

---

More Than 130 Countries Were Part of the Obfuscation Layer

The global nature of the infrastructure is particularly notable.

The FBI says QTFY's traffic could be routed through compromised devices located in more than 130 countries.

That means this wasn't simply a China-to-U.S. operation.

The infrastructure layer was global.

Devices in third-party countries could unknowingly become intermediate nodes in attacks against American organizations.

This creates consequences for organizations that aren't directly targeted.

A compromised router in one country could effectively become part of an espionage campaign against an organization in another.

The device owner might never realize it.

---

The Campaign Has Been Active Since at Least 2018

U.S. authorities say QTFY's activity dates back to at least 2018.

Over the years, the group developed an ecosystem of tools rather than relying on a single malware family.

The NSA says QTFY developed:

• QScan — vulnerability scanning and exploitation
• QTRouter — traffic obfuscation
• Proxy Platform Management — managing compromised proxy infrastructure
• Proxy Pool Management System — managing proxy resources
• QTBotnet — managing compromised IoT devices

Together, these components created something closer to a cyber operations platform than an isolated piece of malware.

That distinction is important.

Modern cyber operations increasingly resemble software platforms.

Different components perform different functions.

One discovers victims.

Another compromises infrastructure.

Another manages infected systems.

Another hides traffic.

Another maintains access.

The attacker essentially builds a complete operational stack.

---

The FBI Didn't Just Block the Attackers

The takedown is technically interesting because investigators targeted the infrastructure the attackers themselves depended upon.

The FBI and DOJ didn't simply publish an advisory telling organizations to block QTFY traffic.

They obtained court authorization to seize domains used by QScan and QTRouter.

Because those domains were embedded into the malware and necessary for communication and authentication, the seizure disrupted the underlying platforms themselves.

This is an example of an increasingly important law-enforcement strategy:

Attack the attacker’s infrastructure, not just the attacker.

If the infrastructure is centralized enough, taking control of critical components can interrupt operations at scale.

---

Part of a Larger U.S. Cyber Disruption Strategy

The QTFY operation isn't happening in isolation.

The DOJ highlighted several previous technical operations against China-linked cyber infrastructure.

In 2025, the FBI removed PlugX surveillance malware from more than 4,000 U.S. computers infected by the China-linked Mustang Panda group.

In 2024, the FBI disabled a botnet consisting of hundreds of thousands of infected IoT devices that U.S. authorities said was being provided to Chinese government customers by Flax Typhoon.

And in 2023, the FBI disrupted infrastructure used by Volt Typhoon to conceal exploitation of U.S. and foreign critical infrastructure.

The pattern is becoming clear:

Identify the infrastructure.

Obtain legal authority.

Seize or disrupt critical components.

Use technical intelligence to identify victims and indicators.

Publish defensive guidance.

Raise the cost of future operations.

---

What Organizations Should Learn From This

The QTFY case offers several defensive lessons.

1. Patch internet-facing systems quickly

QTFY reportedly exploited both newly discovered and already-known vulnerabilities.

Internet-facing infrastructure should therefore receive priority during vulnerability management.

Routers, firewalls, VPN appliances, web applications and other edge devices are particularly important.

---

2. Don't ignore IoT devices

IoT devices are increasingly becoming part of attacker infrastructure.

A security camera or router might not contain sensitive company data, but if compromised, it can become:

A proxy.

A botnet node.

A scanning platform.

An attack relay.

Organizations should maintain inventories of internet-connected devices and remove unnecessary exposure.

---

3. Isolate critical systems

The NSA, FBI and CNMF specifically recommend isolating critical systems from edge devices.

An attacker compromising an internet-facing device shouldn't automatically gain a path toward the organization's most sensitive systems.

Network segmentation remains one of the best ways to limit blast radius.

---

4. Hunt for compromised infrastructure

Organizations should not only look for malware on endpoints.

They should investigate unusual:

• Outbound connections
• Proxy behavior
• Authentication attempts
• IoT communications
• DNS activity
• Traffic patterns
• Credential usage
• Connections to known malicious infrastructure

The joint advisory provides indicators of compromise that defenders can use for threat hunting.

---

5. Audit internet-facing applications

The agencies also recommend regularly auditing public-facing websites and applications to prevent unintended disclosure of operational information.

Attackers don't always begin with an exploit.

Information exposed by an organization can make reconnaissance easier.

---

⚠️ The Bigger Problem: Compromised Infrastructure Is Becoming a Weapon

The most important lesson from QTFY may not be the seizure itself.

It's the infrastructure model.

Attackers are increasingly building systems where the final victim sees someone else's computer.

That makes attribution harder.

It makes blocking harder.

And it potentially turns ordinary internet-connected devices into participants in nation-state cyber operations without their owners knowing.

A vulnerable router isn't just a security problem for the person who owns it.

It can become part of someone else's attack infrastructure.

---

🔮 What Happens Next?

The FBI's takedown is a significant disruption, but it does not necessarily mean QTFY has disappeared.

Cyber operations can be rebuilt.

Domains can be replaced.

Infrastructure can be recreated.

Compromised devices can potentially be recruited again.

Attackers can modify malware to communicate with new command infrastructure.

And other proxy networks can be established.

The real measure of success will therefore be whether the operation creates a lasting increase in cost and friction for the actors behind QTFY.

The FBI and NSA have already published technical indicators to help defenders identify the group's activity, giving organizations an opportunity to detect related infrastructure and harden their networks.

---

Final Takeaway

The FBI's disruption of QScan and QTRouter exposes a modern model of state-linked cyber operations.

This wasn't simply a hacker sitting behind a computer attacking NASA.

It was an ecosystem. Vulnerability scanners found exposed systems. Compromised IoT devices became infrastructure.

Botnets provided scale. Proxy networks concealed origins. Commercial and freelance cyber capabilities expanded the group's reach. And government customers could potentially use those capabilities for strategic intelligence collection. The takedown shows that disrupting a sophisticated cyber operation doesn't always require finding every hacker behind it. Sometimes, the most effective move is to find the infrastructure that makes the operation possible — and take that infrastructure away.

For defenders, the message is equally straightforward: Patch the edge. Secure IoT. Segment critical systems. Monitor outbound traffic. Hunt for compromised infrastructure. And don't assume that a familiar IP address means a familiar attacker. The device connecting to your network might not be the attacker. It might be another victim. And somewhere behind it, someone else could be pulling the strings.