FBI Dissects QTFY: How a Contractor-Backed Threat Actor Leverages Custom 'QScan' and 'QTRouter' Mesh Platforms
A joint advisory from the FBI, NSA, and CNMF details the operational tooling of QTFY, a PRC-linked threat actor tied to Nanjing Xinjiuwei Network Technology Co. Active since 2018, the group focuses on targeting US critical infrastructure, the defense industrial base, government agencies, and higher education. In 2024 alone, QTFY compromised over 300 organizations globally by exploiting edge-device vulnerabilities, including Check Point Quantum Gateways. QTFY relies on an in-house reconnaissance platform named 'QScan' to perform automated subdomain enumeration, TLS certificate indexing, and vulnerability scanning. The FBI observed QScan orchestrating over two million scanning and pen-testing jobs in a single 24-hour window. To mask intrusion traffic, the actors route operations through 'QTRouter,' an obfuscation mesh powered by compromised IoT gear and modified OpenWrt firmware. The group actively acquires exploits via freelance cyber contractor marketplaces, rapidly operationalizing zero-day and N-day flaws against their pre-cataloged asset database. Persistence is established via web shells, remote access trojans, and stolen valid credentials. Attack traffic routinely emerges from residential or nearby IoT proxy nodes, blending into normal egress noise. The US Department of Justice and the FBI have announced coordinated disruption operations against the QScan and QTRouter infrastructure.
Read more about FBI Dissects QTFY: How a Contractor-Backed Threat Actor Leverages Custom 'QScan' and 'QTRouter' Mesh Platforms