The FBI, National Security Agency and US Cyber Command’s Cyber National Mission Force said QTFY, also known as QT and QTCYBER, developed purpose-built systems that allowed hackers to identify vulnerable devices at scale, exploit weaknesses and conceal the origin of malicious traffic. The August 26 advisory described activity affecting US and overseas organisations across defence, communications, government, energy, higher education and other sectors.
The Justice Department said investigators seized three internet domains essential to QScan, a vulnerability-scanning and exploitation platform, and QTRouter, an obfuscation network. Because those domains were hard-coded into the malware for communication and authentication, authorities said the seizures rendered both platforms inoperable.
Officials linked QTFY to Nanjing Xinjiuwei Network Technology Company, a China-based private firm. An FBI affidavit alleges payments from China’s Ministry of State Security indicate the company carried out malicious cyber activity on behalf of the Chinese government. US authorities also said organisations associated with China’s intelligence and military establishments used services provided through the infrastructure.
The government has since narrowed some of its initial claims about affected US agencies. The Justice Department updated its announcement on August 28 to clarify that NASA, the Federal Reserve, the Senate and several federal departments were targets, but that being targeted did not necessarily mean their networks had been compromised.
The FBI affidavit said an attempted breach of NASA failed because the agency had patched the software being targeted. It separately alleged successful computer intrusions in September 2024 at three Department of Energy national laboratories, the National Institutes of Health, a Health and Human Services agency and a US security-device manufacturer.
The joint advisory said QScan operated as a distributed system capable of handling very large numbers of reconnaissance and penetration-testing jobs. Its infrastructure included leased servers outside China and a database containing more than 200 proof-of-concept exploits written in Python. On one day in 2024, the system processed more than two million scanning and penetration-testing tasks, according to the advisory.
QTRouter provided another layer by routing traffic through commercial proxy services, cloud infrastructure and compromised internet-connected devices. The agencies said the system could chain proxy nodes together, helping malicious activity blend with legitimate traffic and making it harder for defenders to identify the attackers’ true location.
QTFY also maintained at least three systems for managing botnets of compromised Internet of Things devices: Proxy Platform Management, Proxy Pool Management System and QTBotnet. Authorities said those devices could be enrolled as proxy nodes, expanding the distributed network available for concealment and other malicious operations.
The advisory said QTFY exploited both previously unknown vulnerabilities and already disclosed flaws, while obtaining legitimate credentials from compromised systems to preserve access. Investigators also described the group as active in freelance hacking networks and markets where malware, exploits and access to compromised systems were traded.
A May 2024 campaign cited by the agencies resulted in data being stolen from more than 300 organisations worldwide after exploitation of a vulnerability in Check Point Quantum Gateway products. The affected organisations included unnamed defence contractors, financial institutions and universities. Separate attempts against the US Senate and a hospital in March 2026 were unsuccessful.
The agencies urged organisations to install current software and firmware updates, audit public-facing websites and applications, separate critical systems from edge devices and search networks for indicators identified in the advisory. They cautioned defenders to investigate indicators before automatically blocking addresses because QTRouter mixed malicious traffic with legitimate commercial proxy traffic.
FBI Cyber Division Assistant Director Brett Leatherman said the operation was intended to impose costs on state-sponsored actors while giving network defenders information to identify QTFY activity. Authorities said the published technical material includes tactics, infrastructure and indicators of compromise derived from investigations and incident-response work across cases.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
