The short answer
On August 26, 2026, the DOJ and FBI announced the court-authorized seizure of three domains that powered QScan and QTRouter — two hacking platforms operated by the China state-sponsored group QTFY (Nanjing Xinjiuwei Network Technology), working on behalf of China’s Ministry of State Security and People’s Liberation Army. QScan automatically compromised thousands of IoT devices globally; QTRouter funneled attack traffic through them to mask origins. Confirmed victims include NASA, the Federal Reserve, the Departments of Energy and Justice, HHS, NIH, the US Senate, hospitals, and financial institutions. The operation ran continuously from 2018 to 2026. The CVEs exploited cover Fortinet, Citrix, Exchange, F5, Log4j, Confluence, Ivanti, and BeyondTrust — standard enterprise perimeter products.
How QScan and QTRouter worked
QScan was an automated scanner that continuously probed the internet for vulnerable IoT devices — routers, cameras, network appliances, and commercial servers. When it found an exposed device matching a known CVE, it infected it automatically without human intervention. The compromised devices were then added to QTRouter, a proxy botnet that routed QTFY’s attack traffic through systems located physically outside China.
The two-platform architecture solved a persistent operational problem for state-sponsored attackers: attribution. When the actual intrusion traffic exits through a residential router in Ohio or a cloud VPS in Germany, the receiving organization sees a local-looking source IP, not a Chinese one. Standard IP-based threat intelligence is blind to this pattern. The FBI described QTRouter as making attacks “appear locally sourced rather than originating from China.”
Both platforms relied on three hard-coded domains — qtproxy.xyz, qt-proxy.org, and qt-team.com — for authentication and command-and-control. That architectural decision was their undoing: seizing the domains made both platforms inoperable simultaneously, without requiring arrests or physical access to infrastructure.
Who was targeted — and for how long
The operation ran from 2018 to 2026 — eight years of continuous access across US critical infrastructure. Confirmed targets disclosed in court documents include NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the US Senate. Beyond federal agencies, victims included hospitals, financial institutions, telecom providers, and defense contractors.
The breadth is deliberate. QTFY’s clients — the Ministry of State Security and PLA — use persistent access to multiple sectors simultaneously. A hospital provides patient data and research pipelines. A financial institution provides transaction flow and regulatory reporting. A telecom provider provides communications interception capability. These are not opportunistic breaches; they are long-duration collection operations.
The CVE list: your enterprise software is on it
The penetration testing community has documented QTFY’s exploitation targets in court filings. The CVEs span products that appear on nearly every enterprise perimeter inventory:
- Fortinet SSL-VPN — the VPN gateway used by tens of thousands of organizations for remote access
- Citrix ADC — application delivery and load balancing, often internet-facing
- Microsoft Exchange — on-premises email servers, a perennial target due to complexity and slow patching cycles
- F5 BIG-IP — load balancers and traffic management systems in financial and healthcare environments
- Apache Log4j — the library vulnerability that dominated 2021 disclosure windows and apparently remained unpatched in some environments through 2026
- Atlassian Confluence — internal documentation and project wikis, common in software development organizations
- Check Point gateways — firewall and network security appliances
- CrushFTP — file transfer servers, common in regulated industries handling large data sets
- Ivanti appliances — VPN and endpoint management systems with a history of zero-day exploitation in 2024–2026
- BeyondTrust Remote Support — privileged access management for remote IT operations
The pattern across this list is consistent: internet-facing appliances with delayed patching cycles. None of these vulnerabilities required sophisticated zero-day research. They were known, CVE-assigned, vendor-patched flaws where the gap between patch availability and patch deployment opened the door.
How the FBI shut it down
The FBI obtained warrants through the Southern District of California to seize the three hard-coded C2 domains. Once seized, QScan could no longer authenticate infected devices, and QTRouter lost its command infrastructure. Both platforms went dark simultaneously. There were no arrests; attribution was confirmed via MSS payment records to Nanjing Xinjiuwei, which include former PLA members on staff.
The seizure approach — targeting shared infrastructure rather than individual infected machines — is becoming standard practice for US law enforcement countering state-sponsored botnets. It is operationally faster than attempting to clean thousands of individually compromised IoT devices across multiple jurisdictions, and it forces adversaries to rebuild from scratch rather than simply re-register a domain.
What it means for US & EU software teams
Unpatched perimeter appliances are the nation-state entry point of record. The QTFY CVE list should be treated as a priority patch inventory, not a historical curiosity. Log4j appeared on it in 2026 — nearly five years after the initial disclosure. Organizations that say “we’re not a government target” should reconsider: the Federal Reserve and NIH were on this list alongside hospitals and defense contractors. Supply chain and financial data in any organization that touches a regulated sector are attractive collection targets.
IoT devices in your environment are botnet material. QTRouter was built from compromised cameras, routers, and appliances — the same category of device found in development labs, office networks, and staging environments. An unmanaged IP camera in a server room is not a theoretical risk; it is the infrastructure that makes attacks like QTFY’s proxy routing possible. Network segmentation that isolates IoT devices from systems handling sensitive data reduces blast radius when a device is compromised.
IP-based attribution is unreliable for nation-state traffic. QTRouter specifically defeated IP allowlists and country-based blocking by routing through domestic IPs. For cloud and DevOps teams maintaining security group rules and WAF policies: traffic from expected geographic regions is not the same as trusted traffic. Behavioral anomaly detection, endpoint telemetry, and Zero Trust network policies provide the layers that raw IP rules do not.
FinTech and HealthTech teams face the same threat profile as the Federal Reserve and NIH. The targets in this operation are the exact industries YuSMP’s clients operate in. GDPR and HIPAA breach notification timelines assume incidents are detected in days or weeks; QTFY operated for eight years before seizure. Long-duration, low-and-slow intrusions do not trigger the threshold-based alerts that most SIEM configurations are tuned to catch.
Is your perimeter on the QTFY CVE list?
Our engineers conduct security audits and penetration tests that map your internet-facing attack surface against known exploitation patterns, including the appliance CVEs used in nation-state operations. We deliver a prioritized remediation roadmap with patch timelines matched to your deployment cycle. Engagements typically run two to four weeks.
Request a security auditWhat dev teams should do now
| Action | Timeline | Notes |
|---|---|---|
| Patch Fortinet SSL-VPN, Citrix ADC, F5 BIG-IP, Ivanti, BeyondTrust Remote Support to current versions | This week | All five are on the QTFY exploitation list and all have current vendor patches; delay after a disclosed breach operation is indefensible in any compliance audit |
| Audit all Exchange on-prem installs for applied Cumulative Updates | This week | On-prem Exchange remains a high-value target; if your organization cannot maintain a monthly CU cadence, cloud migration is a lower-risk posture than continued self-hosting |
| Search for Log4j dependencies across all services, including transitive dependencies | This sprint | Log4j appearing in a 2026 operation means organizations still run it; a dependency graph scan costs less than an incident response engagement |
| Inventory and segment IoT devices on all networks | This sprint | Network segmentation isolating cameras, access control hardware, and unmanaged appliances from internal systems limits the pivot potential of any compromised device |
| Review SIEM alert thresholds for long-duration, low-volume anomalies | Next sprint | Standard threshold-based alerting misses eight-year persistence; behavioral baselines and user entity analytics (UEBA) catch the anomalies that volume rules do not |
| Apply Zero Trust network policies on cloud-connected workloads | Next quarter | Zero Trust removes implicit trust from network location, defeating the IP-spoofing benefit of QTRouter-style proxy infrastructure |
Sources: US Department of Justice — Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure (DOJ Office of Public Affairs, August 26, 2026); Security Affairs — FBI Seizes China-Linked Hacking Platforms QScan and QTRouter (Security Affairs, August 27, 2026); UPI — DOJ seizes 2 platforms used by China-supported hackers (UPI, August 26, 2026).
FAQ
What are QScan and QTRouter?
QScan is an automated IoT vulnerability scanner and infector operated by China state-sponsored group QTFY. It scanned the internet for exposed IoT devices and automatically compromised thousands of them. Those compromised devices were added to QTRouter, a proxy botnet that routed malicious attack traffic through systems located outside China, masking the true origin of attacks against US critical infrastructure.
Which US agencies and organizations were targeted?
Confirmed targets include NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the US Senate, as well as hospitals, financial institutions, telecom providers, and defense contractors. The operation ran from 2018 to 2026.
What CVEs did QTFY exploit to breach these organizations?
The group leveraged known vulnerabilities across common enterprise perimeter products: Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Apache Log4j, Atlassian Confluence, Check Point gateways, CrushFTP, Ivanti appliances, and BeyondTrust Remote Support. Both patched and newly disclosed vulnerabilities were used, indicating organizations consistently failed to apply timely updates.
How did the FBI and DOJ dismantle the platforms?
The FBI obtained court-authorized warrants to seize three domains hard-coded into both malware variants: qtproxy.xyz, qt-proxy.org, and qt-team.com. Those domains handled authentication and command-and-control. Seizing them rendered both QScan and QTRouter inoperable simultaneously, without requiring arrests or physical access to overseas infrastructure.
What should enterprise software teams do in response?
Three immediate priorities: (1) Audit and patch all internet-facing appliances on the CVE list — especially Fortinet SSL-VPN, Citrix ADC, F5 BIG-IP, Ivanti, and BeyondTrust Remote Support. (2) Inventory and segment IoT devices on development, staging, and office networks — compromised cameras and routers are the building blocks of proxy botnets like QTRouter. (3) Review outbound proxy traffic patterns for behavioral anomalies; QTRouter routes traffic through legitimate-looking external IPs, so IP-based attribution alone is insufficient.