U.S. Seizes Chinese Hacking Infrastructure Used to Hide Cyberattacks
QScan and QTRouter allegedly turned thousands of compromised IoT devices into a global network for concealing attacks on sensitive U.S. networks
Illustration: Rafael Minguet Delgado via pexels.com
The U.S. Justice Department and FBI have seized domains used by two hacking platforms allegedly operated by a Chinese state-linked group, disrupting infrastructure used to conceal cyberattacks against U.S. government and critical infrastructure networks.
The platforms, QScan and QTRouter, were operated by QTFY, which the Justice Department links to Nanjing Xinjiuwei Network Technology Company. According to U.S. court documents, the company's customers included China's Ministry of State Security and the People's Liberation Army.
The operation is notable for the way the infrastructure allegedly worked.
QScan scanned for vulnerable internet-connected devices and automatically infected thousands of them worldwide. Those devices were then incorporated into QTRouter, alongside commercial proxy services and leased virtual private servers.
Together, they created what investigators describe as an “obfuscation network,” allowing attackers to route malicious traffic through compromised systems outside China — potentially even through devices located near their targets.
That made attacks appear to originate from elsewhere, obscuring their Chinese origin.
The FBI said the seized domains were hard-coded into the malware and used for essential functions including communication and authentication. Seizing them therefore rendered both platforms inoperable.
According to a U.S. affidavit, QTFY-linked actors have been active since at least 2018. Their alleged victims include NASA, the Federal Reserve, the Department of Energy, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate.
U.S. authorities also say the group successfully stole data from defense contractors, financial institutions and universities in 2024.
The operation is the latest in a series of U.S. efforts to disrupt Chinese cyber operations by attacking the infrastructure that enables them, rather than waiting for the next intrusion.