DOJ and FBI seize China-linked QScan and QTRouter

The Justice Department and FBI carried out court-authorized domain seizures that took down two complementary China-linked hacking platforms, QScan and QTRouter, according to the DOJ announcement. The action is a seizure of infrastructure, not an indictment: DOJ describes taking the tooling offline, and no charges are announced with it.

Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures, out of the Southern District of California, "made QScan and QTRouter inoperable." Disabling the domains disables the platforms themselves by severing the fixed callback addresses the malware needs to function.

DOJ attributes the platforms to a PRC state-sponsored group it calls QTFY, employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司). The two tools work as a pair: QScan scans and automatically infects thousands of internet-of-things devices worldwide, which are then folded into QTRouter, an "obfuscation network" that routes intrusions through compromised IoT devices, commercial proxies, and leased servers so the traffic appears to originate outside the PRC.

DOJ does not tie this to Volt Typhoon or Salt Typhoon. QTFY is presented as its own operation, and one that sells: DOJ says it offers hacking services to paying customers including the PRC's Ministry of State Security and the People's Liberation Army.

DOJ names, among the victims of QTFY intrusion activity, the National Aeronautics and Space Administration, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. That list reaches a fiscal agency, a nuclear-and-grid department, the government's own prosecutors, and a chamber of Congress through the same commodity IoT-to-proxy pipeline.

Some offers on this page may be paid placements or contain affiliate links.