The QTFY campaign shows how compromised everyday devices can conceal state-linked attacks against critical infrastructure.
US authorities have disrupted two hacking platforms allegedly used by a Chinese state-sponsored group to target government bodies and critical infrastructure.
The Department of Justice and FBI seized domains supporting QScan and QTRouter, platforms linked to a group known as QTFY. US officials said the group operated through Nanjing Xinjiuwei Network Technology, whose customers included China’s Ministry of State Security and People’s Liberation Army.
QScan searched for vulnerable systems and automatically compromised internet-connected devices. Those devices were then incorporated into QTRouter, an obfuscation network that allowed attackers to route their activity through equipment outside China. This made hostile traffic appear to originate closer to its target or from an apparently legitimate location.
A joint advisory from the FBI, NSA and Cyber National Mission Force said QScan processed more than two million scanning and penetration-testing tasks on a single day in 2024. The group allegedly targeted defence contractors, energy companies, telecommunications providers, financial institutions, universities and government agencies.
According to Reuters, some attempted intrusions were unsuccessful, while others resulted in data theft. China denied involvement and accused the US of using cyber-security concerns to discredit Chinese companies.
The campaign demonstrates why organisations cannot rely heavily on the apparent geographic origin or reputation of network traffic. Compromised routers and other devices can make state-sponsored activity resemble ordinary domestic connections.
Defenders should isolate critical systems from edge devices, apply current firmware and software updates, and investigate historical activity linked to the published indicators of compromise. The domain seizures may interrupt the platforms, but previously compromised devices and stolen credentials could still provide access.
For risk leaders, the case also shows how state espionage increasingly draws on commercial suppliers, automated scanning and large networks of third-party infrastructure. Understanding that wider ecosystem is becoming as important as identifying the individual group behind an attack.
