Overview
- In late August federal law enforcement used court orders to seize core domains used by QScan and QTRouter, making those domain-dependent functions inoperable and disrupting the platforms’ command-and-control.
- The Department of Justice revised its public statement to say several named agencies were ‘‘among the targets’’ of QTFY rather than confirmed victims, noting targeting does not prove successful compromise.
- A law enforcement affidavit links the QTFY operator to Nanjing Xinjiuwei Network Technology Co. and cites payments from China’s Ministry of State Security as evidence the group worked for Chinese intelligence.
- Investigators say QScan is a mass scanner and exploit tool that infected thousands of internet-connected devices and QTRouter assembled those devices, rented virtual servers, and commercial proxies into Operational Relay Box (ORB) networks and an encrypted relay layer called Fast Labyrinth to hide attacker origins.
- Officials say technical operations and follow-up investigations continue to look for evidence of data theft, to remove malware from infected devices, and to guard against the group rebuilding its relays, with potential legal and diplomatic consequences still unfolding.