The US Justice Department and the FBI said on Wednesday that they have seized three internet domains and, by doing so, switched off two hacking platforms that Chinese state backed intruders used against American government agencies and critical infrastructure. Because the domains were written directly into the tools and handled their communication and authentication, taking them away left both platforms unable to function.
The platforms are called QScan and QTRouter. Court documents attribute them to a group known as QTFY, which the government says works for Nanjing Xinjiuwei Network Technology Company. According to those documents the group includes former members of the People's Liberation Army, and the company has been paid by China's Ministry of State Security.
The list of organizations QTFY went after is long and specific. The Justice Department names NASA, the US Senate, the Federal Reserve and the National Institutes of Health, along with three federal departments: Energy, Health and Human Services, and Justice itself.
A supplier, not just a crew
What sets QTFY apart is its role. Researchers at Black Lotus Labs, the threat research team at Lumen Technologies, have followed its infrastructure for the past year and describe it as a quartermaster: an outfit that builds and runs the plumbing other operators need, then lets them use it.
The two seized platforms did different jobs. QScan searched the internet for vulnerable devices and for weaknesses in target networks, and it could exploit what it found. Routers and other connected devices it compromised were folded into QTRouter, which mixed those hijacked machines with rented servers and nodes bought from commercial proxy services. An operator connecting through QTRouter appeared to be coming from an ordinary address outside China, sometimes one close to the organization being targeted.
Lumen describes two further pieces. One is an encrypted relay network it calls Fast Labyrinth, assembled largely from paid access to a Chinese commercial proxy provider, so that espionage traffic travels alongside the traffic of regular paying customers. The other, QTProxy, is the management tool operators use to pick relays and set up their own routes through that network.
According to the FBI, the group has been building tools and trading exploits since 2018. Its intrusions relied on a mix of previously unknown flaws and old, well documented ones in the kind of equipment that sits at the edge of a network, such as VPN gateways and mail servers.
What the seizure changes
Seizing domains is a blunt instrument, but here it hit a real dependency. A tool that cannot reach its control servers cannot hand out scanning jobs or authenticate its users, and both platforms stopped working once the court order was carried out. Lumen says it has separately cut off traffic to the parts of the infrastructure it had identified.
Nobody involved is claiming the problem is solved. No arrests were announced, and rebuilding with new domains is a matter of time and effort. Lumen also cautions that simply blocking known addresses will not protect a network against this kind of setup, because the traffic arrives through commercial proxy services whose exit points change constantly.
The FBI published indicators alongside the announcement that defenders can use to check for past activity. For most organizations the practical advice is familiar: keep routers, firewalls and other internet facing devices patched and properly configured, since those are both the way in and the raw material for the next relay network.
