FBI Strikes Back: Unmasking and Disrupting China’s QTFY Cyber Espionage Network

FBI Delivers Decisive Blow to China-Linked Cyber Espionage

In a significant victory against state-sponsored cyber threats, the U.S. Department of Justice (DoJ) has announced the successful disruption of two sophisticated hacking platforms, QScan and QTRouter. These tools, operated by the notorious Chinese state-sponsored group known as QTFY, were meticulously designed to infiltrate and compromise critical infrastructure and sensitive networks across the United States. QTFY, reportedly operating under the guise of Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), has been a persistent digital menace.

The scale of QTFY’s ambition and reach is staggering. According to the DoJ, their victims include high-profile U.S. entities such as the National Aeronautics and Space Administration (NASA), the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and even the U.S. Senate. This extensive targeting underscores the strategic importance of the intelligence and data sought by the group.

A Long-Standing Threat Unveiled

Security researcher Damon Rouse of Lumen Black Lotus Labs, who has been tracking QTFY’s activities for over 18 months, revealed that this digital quartermaster has been operational since at least May 2018. Nanjing Xinjiuwei Network Technology Company reportedly boasts powerful clients, including China’s Ministry of State Security (MSS) and the People’s Liberation Army (PLA), highlighting the direct link to the Chinese state apparatus.

Lumen’s collaboration with the U.S. Federal Bureau of Investigation (FBI) on QTFY began approximately a year ago, culminating in this recent disruption. “The targeting was throughout the western world and beyond, especially with regard to academia,” Lumen noted, adding, “They just love hitting research communities given the collaborative nature of advanced science.” This global reach and focus on intellectual property theft underscore the broad scope of China’s cyber espionage efforts.

The Mechanics of Deception: QScan and QTRouter

FBI Director Kash Patel emphasized the significance of the operation: “Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure. These tools were used by PRC cyber actors to hide the origin of their attacks.”

QScan: The IoT Infiltrator

QScan serves as the initial reconnaissance and infection tool. It systematically scans and exploits vulnerable Internet of Things (IoT) devices worldwide, subsequently adding them to the QTRouter network. The FBI explained, “QScan is used to exploit vulnerable IoT devices and identify vulnerabilities in victim networks. QTFY uses botnet products to control the compromised IoT devices and include them as QTRouter proxy nodes.” This strategy allows QTFY-affiliated actors to “blend in with legitimate users when targeting victim organizations,” making detection exceedingly difficult.

QScan’s operations were linked to domains like qt-proxy[.]org and mq-task.qt-proxy[.]org (formerly mq-task.qt-team[.]com), which managed scanning tasks for worker nodes primarily hosted on leased servers outside China, and mq-result.qt-proxy[.]org (formerly mq-result.qt-team[.]com), which collected the results.

QTRouter: The Obfuscation Engine

QTRouter is the core of QTFY’s obfuscation strategy. Comprising both compromised IoT devices and legitimate commercial proxy services and leased virtual private servers (VPSs), it creates a complex network designed to mask the true origin of cyber intrusions. By routing malicious traffic through these diverse endpoints, QTRouter gives the impression that attacks originate from locations outside China, often appearing local to the targeted networks.

Operating on routers equipped with custom OpenWrt software, QTRouter authenticates to administration servers at “www.qtproxy[.]xyz” and “securelink.qtproxy[.]xyz.” The FBI detailed that “QTRouter uses Clash to establish proxy connections,” enabling actors to view and chain nodes together for maximum obfuscation. This intricate layering, mixing malicious traffic with legitimate activity on commercial proxies and leveraging compromised IoT devices, significantly hinders efforts to identify and track the perpetrators.

The Full Attack Cycle and Its Disruption

QTFY’s attack methodology was a multi-stage process:

1. Reconnaissance: Utilizing QScan to map victim networks.
2. Initial Access: Exploiting a wide array of vulnerabilities, including zero-day flaws (e.g., CVE-2024-8190, CVE-2024-8963, CVE-2024-9380 in Ivanti CSA) and N-day vulnerabilities in popular software like Fortinet SSL-VPN (CVE-2018-13379), Citrix ADC (CVE-2019-19781), Microsoft Exchange Server (CVE-2021-26855), Apache Log4j (CVE-2021-44228), and many others.
3. Persistence: Establishing long-term access through remote access trojans (RATs), web shells, and stolen legitimate credentials.
4. Exfiltration & Obfuscation: Employing QTRouter to access victim networks from nearby compromised IoT devices, allowing them to operate undetected.

The FBI’s court-authorized action targeted and seized the domains hard-coded into both QScan and QTRouter, effectively severing the command and control infrastructure. This decisive move has crippled QTFY’s ability to operate, marking a critical success in the ongoing battle against sophisticated state-sponsored cyber espionage and safeguarding vital U.S. interests.

For more details, visit our website.

Source: Link