DOJ Disrupts QScan and QTRouter Platforms Attributed to China-Linked QTFY
Summary
U.S. DOJ says it disrupted QScan and QTRouter, platforms attributed to China-linked QTFY that scanned vulnerable IoT devices and routed attacks through compromised devices and commercial proxies. The FBI and Lumen described targets and attack methods.
Key points
- The U.S. Department of Justice announced a court-authorized disruption of QScan and QTRouter, saying the platforms were used to target U.S. critical infrastructure and sensitive networks.
- The FBI attributes the activity to China-linked QTFY, which Lumen says has been active since 2018.
- QScan reportedly scanned and infected vulnerable IoT devices, adding them to QTRouter and identifying vulnerabilities in victim networks.
- QTRouter used compromised devices, commercial proxy services and leased VPSs to obscure the origins of activity; it reportedly ran on routers using custom OpenWrt software and used Clash for proxy connections.
- The article describes an attack chain involving zero-day and older vulnerabilities, followed by persistence using remote access trojans, web shells or legitimate credentials.
- The DOJ named NASA, the Federal Reserve, the Departments of Energy and Justice, HHS, NIH and the U.S. Senate among organizations targeted by QTFY activity.
- The FBI said seized domains were hard-coded into the platforms, causing them to cease operating after the disruption.
Article Details
- Event Type
- The U.S. Department of Justice announced a court-authorized disruption of the QScan and QTRouter platforms and associated infrastructure used by the China-linked QTFY group.
- Impact
- The platforms were used to scan and infect vulnerable IoT devices, route traffic through compromised devices and proxy services, and conceal the origins of intrusions targeting U.S. critical infrastructure and other organizations. The article names NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate among victims. The FBI said the disruption affected a global botnet and hacking platform.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | qt-proxy[.]org | QScan-associated domain hosting components of the system; identified as part of the disrupted infrastructure. |
| HOSTNAME | mq-result[.]qt-proxy[.]org | QScan result server that received completed tasks; identified as part of the disrupted infrastructure. |
| HOSTNAME | mq-result[.]qt-team[.]com | Previous hostname for the QScan result server. |
| HOSTNAME | mq-task[.]qt-proxy[.]org | QScan task server that provided scanning tasks to worker nodes; identified as part of the disrupted infrastructure. |
| HOSTNAME | mq-task[.]qt-team[.]com | Previous hostname for the QScan task server. |
| HOSTNAME | securelink[.]qtproxy[.]xyz | QTRouter administration server used by the malicious platform. |
| HOSTNAME | www[.]qtproxy[.]xyz | QTRouter administration server used by the malicious platform. |
MITRE ATT&CK
T1078 · Valid AccountsThe article says legitimate credentials were used to establish persistence.T1090 · ProxyQTRouter used compromised devices and proxy services to obscure the origins of malicious traffic.T1505.003 · Web ShellThe article says web shells were used to establish persistence.T1595 · Active ScanningQScan conducted reconnaissance by scanning victim networks.
CVE
CVE-2018-13379CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380 in Ivanti CSA appliances) and N-day vulnerabilities (CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in Microsoft Exchange Server,CVE-2019-10068in Citrix ADC, CVE-2021-26855 in Microsoft Exchange Server, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 in Atlassian Confluence,CVE-2019-19781in Ivanti CSA appliances) and N-day vulnerabilities (CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in Microsoft Exchange Server, CVE-2020-5902 in F5 BIG-IP,CVE-2020-5902in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in Microsoft Exchange Server, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 inCVE-2021-26855and N-day vulnerabilities (CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in Microsoft Exchange Server, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS,CVE-2021-44228in Microsoft Exchange Server, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 in Atlassian Confluence, CVE-2024-24919 in Check Point QuantumCVE-2023-22515Server, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 in Atlassian Confluence, CVE-2024-24919 in Check Point Quantum Gateway, CVE-2025-31161 in CrushFTP,CVE-2024-24919in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 in Atlassian Confluence, CVE-2024-24919 in Check Point Quantum Gateway, CVE-2025-31161 in CrushFTP, and CVE-2026-1731 in BeyondTrust RemoteCVE-2024-8190Exploit zero-day (e.g., CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380 in Ivanti CSA appliances) and N-day vulnerabilities (CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in MicrosoftCVE-2024-8963Exploit zero-day (e.g., CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380 in Ivanti CSA appliances) and N-day vulnerabilities (CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in MicrosoftCVE-2024-9380Exploit zero-day (e.g., CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380 in Ivanti CSA appliances) and N-day vulnerabilities (CVE-2018-13379 in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in MicrosoftCVE-2025-31161Apache Log4j, CVE-2023-22515 in Atlassian Confluence, CVE-2024-24919 in Check Point Quantum Gateway, CVE-2025-31161 in CrushFTP, and CVE-2026-1731 in BeyondTrust Remote Support) to gain initial access to victimCVE-2026-1731Atlassian Confluence, CVE-2024-24919 in Check Point Quantum Gateway, CVE-2025-31161 in CrushFTP, and CVE-2026-1731 in BeyondTrust Remote Support) to gain initial access to victim networks
People
Threat Actors
Products
Fast LabyrinthFast Labyrinth, which provides the operational layer by incorporating commercial proxy infrastructure such as Fastlink (“fastlink.ws”) into an encrypted relay network along with QTRouter that obfuscates traffic to andQScanDepartment of Justice disrupted QScan and QTRouter, two hacking platforms used by the China-linked QTFY group to target U.S.QTBotnetcommandeered using three major platforms: Proxy Platform Management, Proxy Pool Management System, and QTBotnet, the last of which includes a controller server, secondary-level control servers to maintainQTProxyQTRouter, which functions as a network traffic obfuscation network running on routers with custom OpenWrt software, authenticates to administration servers located at “www.qtproxy[.]xyz” and “securelink.qtproxy[.]xyz.”QTRouterDepartment of Justice disrupted QScan and QTRouter, two hacking platforms used by the China-linked QTFY group to target U.S.