U.S. Seizes Domains Tied to QTFY China-Linked Espionage Operation
Summary
U.S. authorities seized three domains used by QTFY’s QScan and QTRouter platforms, disrupting an operation officials say targeted federal agencies and critical infrastructure since 2018.
Key points
- Federal authorities say QTFY targeted and intruded U.S. agency networks, including those of DOE, DOJ, HHS, the Federal Reserve, NASA and NIH.
- Officials seized three domains, cutting off access to QScan and QTRouter, which they described as the group’s primary platforms.
- According to court records, QScan included more than 200 proof-of-concept exploits; an FBI affidavit says it processed over two million scanning and exploit tasks in one day in 2024.
- Officials said QTFY exploited multiple vendors’ products. In September 2024, the group used Ivanti zero-days to intrude networks including three DOE national laboratories and NIH.
- The group also targeted critical infrastructure sectors, including financial institutions, defense contractors, utilities, telecom providers and hospitals.
- The FBI, NSA and Cyber National Mission Force released a joint advisory with QTFY indicators of compromise.
Article Details
- Event Type
- Federal law enforcement disruption and infrastructure seizure targeting a Chinese state-sponsored espionage operation.
- Impact
- QTFY’s operation targeted and compromised U.S. critical infrastructure and federal networks, including those of the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, and the National Institutes of Health. Officials seized three domains, cutting off access to the group’s QScan and QTRouter platforms. QTFY also targeted financial institutions, defense contractors, utility companies, telecom providers, and hospitals.
MITRE ATT&CK
People
John A. EisenbergAssistant attorney general for national security who commented on the court-authorized infrastructure seizures.Ryan EnglishInformation security engineer at Lumen Technologies’ Black Lotus Labs, which aided the disruption efforts; he described QTFY’s operational capabilities.Todd BlancheAttorney General who commented on the government’s response to state-sponsored attacks on critical infrastructure.
Threat Actors
Vendors
Atlassianin multiple vendors’ products, including Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.BeyondTrustFortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.Check Pointincluding Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.CitrixThe operation used a botnet, scanning tools, and exploited vulnerabilities in products from Ivanti, Fortinet, Citrix, Microsoft, F5, and others to infiltrate sensitive networks.F5The operation used a botnet, scanning tools, and exploited vulnerabilities in products from Ivanti, Fortinet, Citrix, Microsoft, F5, and others to infiltrate sensitive networks.FortinetThe operation used a botnet, scanning tools, and exploited vulnerabilities in products from Ivanti, Fortinet, Citrix, Microsoft, F5, and others to infiltrate sensitive networks.IvantiThe operation used a botnet, scanning tools, and exploited vulnerabilities in products from Ivanti, Fortinet, Citrix, Microsoft, F5, and others to infiltrate sensitive networks.MicrosoftThe operation used a botnet, scanning tools, and exploited vulnerabilities in products from Ivanti, Fortinet, Citrix, Microsoft, F5, and others to infiltrate sensitive networks.
Products
Atlassian Confluencemultiple vendors’ products, including Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.CrushFTPPulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.Kentico CMSin multiple vendors’ products, including Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.Pulse Secureand globally by exploiting vulnerabilities in multiple vendors’ products, including Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust,
Tools
Countries
Industries
DefenseFinancial institutions, defense contractors, utility companies, telecom providers and hospitals have also been targeted by the threat group, which includes former members of China’s military, according to court records.GovernmentOfficials seized domains and unsealed an affidavit detailing how a Chinese government-funded front company assembled a botnet and complementary systems that allowed attackers to intrude highly sensitive networks.