The Justice Department and FBI announced court-authorized seizures of the domains underpinning QScan and QTRouter, two complementary hacking platforms built and operated by a People’s Republic of China state-sponsored group known as QTFY. Alongside the seizure, the FBI and NSA published a joint cybersecurity advisory on August 26, 2026 listing indicators of compromise — domains, IP addresses and file hashes tied to QTRouter node activity — available through IC3.

QTFY is not a military unit or an intelligence directorate. It is a group employed by Nanjing Xinjiuwei Network Technology Company, and it sells computer hacking services to paying customers. Among those customers, per DOJ: the PRC’s Ministry of State Security and the People’s Liberation Army.

The victim list is the part that will hold Washington’s attention:

  • NASA
  • Federal Reserve
  • Department of Energy
  • Department of Justice
  • Department of Health and Human Services
  • National Institutes of Health
  • U.S. Senate

The case was brought in the Southern District of California, where U.S. Attorney Adam Gordon’s office handled the seizure warrants.

How the two platforms worked together

The architecture is elegant in the way that industrialized attack infrastructure usually is, which is to say it separates the boring work from the valuable work.

QScan is the acquisition engine. It scans the internet at scale and automatically infects thousands of internet-of-things devices worldwide — the routers, cameras, DVRs and embedded systems that ship with default credentials, unpatched firmware and no update mechanism, and that sit on residential and small-business networks in every country on earth.

QTRouter is the concealment layer. It stitches the QScan-compromised devices together with commercial proxy service devices and leased virtual private servers into a single obfuscation network. Traffic entering QTRouter emerges from a residential IP address in a location of the operator’s choosing.

The purpose is to defeat attribution and geographic filtering simultaneously. An intrusion attempt against a U.S. federal network arriving from a consumer broadband address in Ohio does not trip the geoblocking rules, does not match threat intelligence on known PRC infrastructure, and does not look like anything until someone correlates it across many victims.

The seizure worked because the domains were hard-coded into both QScan and QTRouter and used for essential functions including command communication and authentication. Taking the domains rendered both platforms inoperable. That is a meaningfully better outcome than most takedowns achieve — this was not a sinkhole that degrades an operation, it was a removal of the components the malware cannot run without.

Lumen Technologies’ Black Lotus Labs published a detailed technical writeup of the group’s tradecraft alongside the government action.

The reconnaissance nobody stopped

The advisory contains three specific scanning events that deserve to be read together:

  • March 2026 — QTFY conducted a vulnerability scan of the U.S. Senate and of an American hospital system
  • June 2026 — QTFY conducted a vulnerability scan of an unidentified U.S. election system

Both intrusion attempts against those networks failed. That is the good news, and officials have been careful to say so.

The scanning itself is the story. A PRC contractor probing an American election system in June 2026 — five months before a federal election — is a reconnaissance activity with an obvious purpose, conducted through infrastructure specifically built to make attribution impossible. The failure to gain access was determined by the target’s defenses, not by the attacker’s restraint.

The pairing of the Senate and a hospital system in a single March campaign is equally telling. Those targets share nothing in terms of intelligence value. What they share is that both are large, complex, chronically underfunded American networks — which is what a broad-spectrum scanning operation looks for.

The contractor model, again

QTFY is the latest confirmation of a structure that Western agencies have spent three years documenting: China does not primarily run offensive cyber operations out of uniformed units. It buys them from a competitive domestic market of private companies.

The i-Soon leaks made this visible in 2024 — an ordinary-looking Chinese IT firm with a sales pipeline, quota-carrying account managers and government customers haggling over price. QTFY at Nanjing Xinjiuwei is the same shape: a company, with employees, that builds tooling once and rents it to multiple state customers.

The operational advantages for Beijing are substantial. Contractors provide deniability, absorb the cost of tool development, compete on capability and price, and can be disowned when burned. The advantage for defenders is narrower but real: companies are legible. They have registrations, addresses, employees, hiring posts and infrastructure leases. That is what makes seizure warrants and indictments possible, and it is why this takedown could name a company in Nanjing rather than a numbered APT.

Attorney General Todd Blanche framed the action in prosecutorial terms: “State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted.”

Where this fits

QTFY joins a crowded field. Our reporting has tracked Salt Typhoon’s five-year telecom campaign and its breach of House committee email systems, T-Mobile physically cutting a cable to evict the group, Google’s dismantling of GRIDTIDE, and the compromise of the FBI’s own wiretap systems.

The pattern across all of them is patience and infrastructure. These operations are measured in years, and their most valuable asset is not an exploit — it is the network of compromised devices that makes the traffic look ordinary. That is precisely what QTRouter was, and it is why seizing hard-coded domains matters more than it sounds.

What defenders should do

The FBI/NSA advisory publishes actionable indicators, and the exposure is not limited to federal agencies:

  1. Ingest the IOCs from the joint advisory at IC3 — domains, IPs and file hashes tied to QTRouter nodes — and run them retrospectively against at least twelve months of network telemetry, not just forward.
  2. Stop trusting residential IP space. QTRouter existed to make attacks arrive from ordinary consumer addresses. Geographic and ASN-based filtering are not detections.
  3. Audit your own IoT estate. Every device QScan infected belonged to someone. Network cameras, DVRs, routers and embedded controllers on your network are candidates for conscription into someone else’s obfuscation layer. Inventory them, change default credentials, segment them, and block their outbound access to anything they do not need.
  4. Read Black Lotus Labs’ technical writeup for the tradecraft detail the advisory summarizes.
  5. Watch your scanning logs. QTFY’s Senate, hospital and election-system probes generated traffic before they generated intrusions. Reconnaissance is the earliest available signal and the one most often discarded as noise.

Sources