The FBI and U.S. Department of Justice have disrupted a sophisticated China-linked cyber operation that allegedly spent years targeting government agencies, critical infrastructure, defense organizations and other sensitive networks.
The operation centered on two interconnected platforms known as QScan and QTRouter, which U.S. authorities say were developed and operated by a Chinese state-sponsored group known as QTFY.
According to court documents, QTFY operates through Nanjing Xinjiuwei Network Technology Company, a China-based company accused by U.S. authorities of selling hacking services to customers that included China's Ministry of State Security (MSS) and People's Liberation Army (PLA).
Among the networks targeted were those belonging to NASA, the Federal Reserve, the Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health and the U.S. Senate.
The campaign is notable not only because of the sensitivity of its targets, but because of the infrastructure used to hide the attacks.
Instead of sending malicious traffic directly from servers obviously associated with China, the attackers routed activity through compromised routers, Internet of Things devices, commercial proxy infrastructure and rented servers around the world.
To a victim organization, an intrusion could therefore appear to originate from an ordinary internet connection — potentially even one geographically close to the target.
FBI Seizes the Infrastructure Behind QScan and QTRouter
On August 26, 2026, the Justice Department announced court-authorized seizures of domains required by QScan and QTRouter.
The domains were hard-coded into the malware and were required for important functions, including authentication and communications.
According to the DOJ, taking control of those domains rendered both platforms inoperable.
FBI Cyber Division Assistant Director Brett Leatherman said the infrastructure routed malicious activity through ordinary internet-connected devices located in more than 130 countries, helping attackers disguise the true origin of their operations.
The action represents a significant disruption.
However, it should not be interpreted as meaning the wider threat has disappeared.
The FBI dismantled key infrastructure supporting the operation. The individuals, organizations and customers allegedly associated with the network may still retain other tools and could attempt to rebuild similar infrastructure.
How QScan Worked
The first component of the system was QScan.
U.S. authorities describe QScan as a vulnerability scanning and exploitation platform.
Its job was essentially to identify potential targets and vulnerable internet-connected systems.
QScan could conduct reconnaissance against organizations while also identifying vulnerable devices that could themselves be compromised.
These devices included systems such as routers, cameras and other IoT equipment.
Compromised devices could subsequently become part of the attack infrastructure rather than simply being end victims.
NSA says QTFY exploited both zero-day vulnerabilities and already-known vulnerabilities to gain access to systems. Once inside, the actors could also obtain legitimate credentials to maintain persistence.
This created an industrialized process:
find vulnerable infrastructure, compromise it, convert some of it into attack infrastructure and then use that infrastructure against higher-value targets.
QTRouter Hid Where the Attacks Really Came From
The second major component was QTRouter.
QTRouter operated as an obfuscation network.
It combined compromised IoT devices with commercial proxy services and rented virtual servers.
Attackers could route their traffic through this distributed network before reaching the intended victim.
That makes attribution and detection significantly more difficult.
A security team examining its logs might see malicious traffic coming from a residential router, commercial proxy server or compromised device in another country rather than infrastructure obviously associated with the attacker.
The DOJ said some traffic could even appear to originate from devices located near the targeted organization.
This technique increasingly appears in sophisticated state-linked operations.
Rather than building obvious command-and-control servers that defenders can identify and block, attackers use large pools of legitimate or compromised infrastructure as operational relay boxes.
Hiding Inside Normal Internet Traffic
Research from Lumen Technologies' Black Lotus Labs provides further insight into how the infrastructure worked.
Researchers tracked what they described as a technical “quartermaster” supporting Chinese cyber-espionage operations.
Its infrastructure combined reconnaissance, proxy management and traffic routing into a reusable service that other actors could use.
One particularly effective technique involved commercial proxy services.
Black Lotus Labs observed malicious communications passing through infrastructure also carrying significant volumes of legitimate consumer internet traffic.
That provided attackers with natural camouflage.
Instead of a suspicious server communicating exclusively with government systems, malicious connections were mixed with ordinary traffic from people using commercial proxy services.
Black Lotus Labs said the vast majority of traffic through some of these routes resembled normal commercial VPN usage.
This creates a serious challenge for defenders.
Blocking a single suspicious IP address may accomplish very little when an attacker can continuously rotate through:
compromised routers, legitimate proxy providers, rented infrastructure and geographically distributed exit nodes.
Black Lotus Labs concluded that traditional static IP blocklists alone are increasingly inadequate against this kind of infrastructure.
NASA and Federal Reserve Were Targets — But Not Necessarily Breached
Initial reporting surrounding the FBI announcement created some confusion over which organizations were successfully compromised.
The Justice Department originally described agencies including NASA and the Federal Reserve as victims.
It later corrected the statement.
On August 28, the DOJ clarified that these organizations were targets, while only some targeted organizations were confirmed to have been successfully compromised.
That distinction is important.
According to the FBI affidavit cited by Reuters, an attempted compromise of NASA was unsuccessful because the agency had patched the software being targeted.
The affidavit does, however, describe successful intrusions elsewhere.
In September 2024, QTFY allegedly compromised systems associated with three Department of Energy National Laboratories, the NIH, an HHS agency and a U.S. security-device manufacturer.
A separate joint cybersecurity advisory also describes successful data theft involving unnamed organizations in sectors including defense, finance and higher education.
The U.S. Senate and a U.S. hospital were also targeted in March 2026, although those attempts were reportedly unsuccessful.
A Campaign Running Since at Least 2018
The operation was not a short-lived intrusion campaign.
U.S. authorities say QTFY activity dates back to at least 2018.
NSA says the group developed a broader ecosystem of malicious tools and services, including QScan, QTRouter and several systems used to manage compromised devices and proxy infrastructure.
The group was also reportedly active within exploit-development communities and freelance hacking markets.
That reflects a broader trend in state-backed cyber operations.
Government agencies do not necessarily need to build every capability internally.
Private companies, contractors, exploit developers and infrastructure providers can supply specialized services.
The result begins to resemble a commercial technology ecosystem — except the products include vulnerability discovery, intrusion capabilities, malware and infrastructure designed to hide cyber operations.
The Alleged Contractor Behind the Operation
U.S. authorities link QTFY to Nanjing Xinjiuwei Network Technology Company.
According to the DOJ, the company provided hacking services to paying customers including Chinese government organizations.
The FBI describes the wider ecosystem as a mixture of hackers-for-hire and government customers.
This contractor model can provide governments with additional scale while also making attribution more complicated.
Cybersecurity companies have increasingly documented Chinese threat activity involving overlapping relationships between state intelligence organizations, private cybersecurity firms, vulnerability researchers and freelance hackers.
The allegations against Nanjing Xinjiuwei fit that broader pattern.
However, attribution should still be described accurately.
These claims come from U.S. government investigators and supporting threat intelligence research.
China disputes U.S. accusations concerning its cyber operations.
Following the August announcement, a Chinese Embassy spokesperson accused the United States of using cybersecurity issues to discredit China and said Beijing opposed what it described as the overextension of national-security concerns.
Why Edge Devices Are So Valuable to Attackers
The operation also highlights a problem that has become increasingly important for enterprise security: routers and other edge devices are now part of the battlefield.
An attacker who compromises an employee workstation gains one foothold.
An attacker who compromises thousands of routers gains something different:
a distributed infrastructure platform.
Those devices can be used to conceal reconnaissance, credential attacks, exploitation attempts and data theft.
Because routers and IoT systems may receive less monitoring than normal servers, attackers can sometimes retain access for extended periods.
And when the compromised device belongs to an unrelated home or business, traffic coming from it may initially appear benign.
This is why organizations should not automatically trust connections simply because they originate from domestic, residential or familiar geographic IP addresses.
Why Traditional IP Blocking Is Becoming Less Effective
Security teams have historically relied heavily on indicators such as malicious IP addresses and hosting providers.
Those controls remain useful.
But networks such as QTRouter demonstrate their limitations.
A threat actor can move through thousands of rapidly changing relay points.
The same malicious operator may appear to come from different countries, networks and providers from one connection to the next.
Conversely, an IP address used for malicious activity may also carry legitimate traffic.
Defenders therefore increasingly need to evaluate behavior, not simply location.
Authentication patterns, device identity, requested resources, privilege escalation, unusual outbound connections and abnormal application behavior can provide more reliable signals than the source IP alone.
What Organizations Should Do
The NSA, FBI and Cyber National Mission Force released a joint advisory alongside the disruption. Their recommendations, combined with the lessons from the campaign, make several defensive actions particularly important:
- Patch internet-facing systems quickly. QTFY reportedly exploited both zero-day and known vulnerabilities. Older vulnerabilities remain useful to attackers when organizations delay updates.
- Update routers, firewalls and IoT firmware. Edge devices should receive the same vulnerability-management attention as traditional servers.
- Isolate critical systems from edge infrastructure. A compromised router or gateway should not automatically provide a path toward sensitive internal systems.
- Hunt for the published QTFY indicators of compromise. Organizations should review historical DNS, proxy, firewall and network-flow records where available.
- Audit internet-facing applications and websites. Reduce unnecessary exposure and identify information that could help attackers map internal infrastructure.
- Use strong authentication and least privilege. Stolen legitimate credentials can allow attackers to maintain access even after the original vulnerability is patched.
- Look beyond geographic IP filtering. Traffic originating near your organization or from a residential network should not automatically be trusted.
- Monitor unusual behavior from edge devices. Unexpected outbound traffic, configuration changes and connections to unfamiliar infrastructure deserve investigation.
- Segment sensitive environments. Government, financial, research, production and administrative networks should not depend on a single perimeter control for protection.
The FBI Is Increasingly Targeting Attack Infrastructure
The QTFY disruption is part of a broader U.S. strategy of taking technical action against infrastructure used by state-backed attackers.
The DOJ highlighted several previous operations.
In 2025, the FBI removed PlugX surveillance malware from more than 4,000 U.S. computers associated with activity attributed to Mustang Panda.
In 2024, authorities disrupted a large IoT botnet linked to Flax Typhoon.
And in 2023, the FBI disrupted infrastructure used by Volt Typhoon to conceal operations against critical infrastructure.
The strategy goes beyond identifying attackers.
By taking over domains, removing malware and disabling command infrastructure, law-enforcement agencies attempt to directly reduce an adversary's operational capability.
QTFY demonstrates why this can be effective.
The compromised devices themselves were distributed across the world, but QScan and QTRouter still depended on central services.
Those dependencies created a point where investigators could intervene.
Disruption Does Not Mean the Threat Is Gone
The operation was a meaningful defensive success.
But organizations should avoid interpreting a takedown announcement as the end of the threat.
Attack infrastructure is replaceable.
Domains can be registered again.
New devices can be compromised.
Proxy providers can change.
New malware can be deployed.
The more important result may therefore be the intelligence generated by the investigation.
The FBI, NSA, CNMF and private researchers now have significantly more visibility into the infrastructure, techniques and operational relationships surrounding QTFY.
For defenders, the released indicators and behavioral information can help identify historical or continuing activity even after the original infrastructure has disappeared.
Final Thoughts
The FBI's disruption of QScan and QTRouter exposes how sophisticated cyber-espionage operations increasingly hide behind the ordinary internet.
According to U.S. authorities, QTFY created an ecosystem capable of scanning for vulnerabilities, compromising internet-connected devices and routing attack traffic through a distributed network that concealed its true origin.
Targets included some of the most sensitive organizations in the United States, including NASA, the Federal Reserve, the Department of Energy, NIH and the U.S. Senate, although investigators stress that being targeted does not necessarily mean an organization was successfully compromised.
The FBI and DOJ have now disabled core components of that infrastructure.
But the techniques behind it will continue to matter.
Attackers increasingly understand that the best way to hide malicious activity is not always to make it invisible.
Sometimes it is to make it look completely normal.
Modern threat detection cannot rely solely on where internet traffic comes from. Organizations need patched edge infrastructure, strong identity controls, segmentation and behavioral monitoring capable of identifying malicious activity even when attackers are hiding behind legitimate-looking connections.
