Lumen Details China-Nexus Cyber Operation’s Shared Proxy and Scanning Infrastructure

Mar 16, 2026 · Original article ↗

Summary

Lumen’s Black Lotus Labs describes a China-nexus infrastructure provider that combines target scanning, commercial proxy relays and operator access systems. Its telemetry links reconnaissance with later proxy traffic to high-value networks.

Key points

Black Lotus Labs describes a four-part system: QScan for reconnaissance, Fast Labyrinth for proxy relays, QTRouter for operator access, and QTProxy for managing proxy nodes.
The report says operators co-opted selected egress nodes from the commercial fastlink[.]ws proxy service, routing activity through consumer traffic to obscure it.
QScan uses distributed workers to scan target networks and return metadata, including banners, open ports and configuration details, to centralized systems.
Lumen reports overlap between networks identified by QScan and destinations later contacted through Fast Labyrinth, while noting the systems may also be used independently.
Observed targeting included research, government, defense, infrastructure and other strategic sectors; Lumen says activity ranged from perimeter mapping to interactive sessions it assesses as probable exploitation.
Lumen says it shared intelligence with U.S. government agencies and null-routed traffic to known infrastructure points. It recommends following CISA and NCSC guidance, reducing external attack surface, and maintaining router, firewall and IoT security updates.

Article Details

Attack Vectors: QScan performed broad perimeter scans and targeted application-layer version sweeps to identify open ports, application banners, kernel fingerprints, trust boundaries, and remote-management interfaces.
Fast Labyrinth routed traffic through selected commercial proxy egress nodes, obscuring traffic to and from target networks.
Quartermaster clients authenticated through QTRouter devices to access the QTProxy management plane and configure proxy paths and traffic-forwarding rules.
The report says confirmed target interfaces were followed by attempted exploitation and interactive sessions routed through Fast Labyrinth; it does not identify a specific exploit.
Defensive Notes: Implement CISA and NCSC guidance for mitigating state-sponsored activity and defending against China-nexus covert networks.
Adopt SASE or similar solutions to reduce the external attack surface.
Regularly reboot routers, firewalls, and IoT devices, and install security updates and patches.
Audit historical netflow and DNS logs for anomalous outbound or bidirectional traffic involving the listed Fast Labyrinth and QScan infrastructure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`instantmessagehub[.]tech`	Identified as a highly probable administrative interface endpoint for Fast Labyrinth.
DOMAIN	`qt-proxy[.]org`	Identified in the IOC matrix as an active Fast Labyrinth infrastructure element.
DOMAIN	`qtproxy[.]xyz`	Administrative domain for the QTProxy system used to manage Fast Labyrinth proxy nodes.
HOSTNAME	`flanycast-hk-bak[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flanycast-hk[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flanycast-jp[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flanycast-sg[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flanycast-tw[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flanycast-us-bak[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flanycast-us[.]yotocloud[.]com`	Commercial proxy egress node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flnode-dl[.]yotocloud[.]com`	Commercial proxy node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`flnode-ulus[.]yotocloud[.]com`	Commercial proxy node identified as co-opted for Fast Labyrinth traffic.
HOSTNAME	`jump[.]qt-proxy[.]org`	Identified as an active operational jump box in the Fast Labyrinth infrastructure.
HOSTNAME	`mq-result-qt-team[.]com`	Identified in the IOC matrix as the QScan results-database infrastructure.
HOSTNAME	`mq-result[.]qt-proxy[.]org`	QScan backend host receiving discovered network metadata.
HOSTNAME	`mq-task-qt-team[.]com`	Identified in the IOC matrix as the QScan task-broker infrastructure.
HOSTNAME	`mq-task[.]qt-proxy[.]org`	QScan task-broker hub used to distribute scanning tasks.
HOSTNAME	`www[.]qtproxy[.]xyz`	Fast Labyrinth proxy-management console used by operators to coordinate relay paths and traffic-forwarding rules.
IPV4	`1[.]32[.]216[.]171`	IP mapped to the QTProxy web panel, described as a main target for Go-http-client logins.
IPV4	`154[.]64[.]238[.]222`	QScan task-broker IP used to manage and distribute scanning tasks.
IPV4	`154[.]64[.]238[.]247`	QScan results-database IP receiving metadata collected by scanner workers.
IPV4	`47[.]76[.]131[.]175`	IP mapped to a highly probable Fast Labyrinth administrative interface endpoint.
IPV4	`8[.]148[.]149[.]147`	IP mapped to the active Fast Labyrinth operational jump box.