Inside cyber espionage infrastructure
A China-nexus infrastructure provider operates as a 'quartermaster' offering reconnaissance, proxy orchestration, and traffic routing services to Chinese cyber espionage actors. The operation consists of four interconnected components: QScan for target reconnaissance, Fast Labyrinth providing encrypted relay networks through co-opted commercial proxy infrastructure, QTRouter managing access to proxy systems, and QTProxy controlling operational nodes. The infrastructure targets research universities, defense networks, government agencies, and critical infrastructure globally, particularly in the U.S., U.K., and Asia-Pacific regions. By exploiting commercial 'Airport' proxy services designed to bypass China's Great Firewall, specifically fastlink.ws, the quartermaster enables multiple threat actors to conduct operations while maintaining anonymity through shared infrastructure, representing a significant evolution in state-sponsored cyber operations.
Indicators of Compromise
- domain: qt-team.com
- domain: qtproxy.xyz
- domain: qt-proxy.org
- domain: mq-task.qt-proxy.org
- domain: mq-result.qt-proxy.org
- domain: www.qtproxy.xyz
- domain: instantmessagehub.tech
- domain: mq-result-qt-team.com
- domain: mq-task-qt-team.com
- domain: flanycast-hk-bak.yotocloud.com
- domain: flanycast-hk.yotocloud.com
- domain: flanycast-jp.yotocloud.com
- domain: flanycast-sg.yotocloud.com
- domain: flanycast-tw.yotocloud.com
- domain: flanycast-us-bak.yotocloud.com
- domain: flanycast-us.yotocloud.com
- domain: flanycast-xxxx.yotocloud.com
- domain: flnode-dl.yotocloud.com
- domain: flnode-ulus.yotocloud.com
- domain: flnode-xxxx.yotocloud.com
- domain: jump.qt-proxy.org
Inside cyber espionage infrastructure
Description
A China-nexus infrastructure provider operates as a 'quartermaster' offering reconnaissance, proxy orchestration, and traffic routing services to Chinese cyber espionage actors. The operation consists of four interconnected components: QScan for target reconnaissance, Fast Labyrinth providing encrypted relay networks through co-opted commercial proxy infrastructure, QTRouter managing access to proxy systems, and QTProxy controlling operational nodes. The infrastructure targets research universities, defense networks, government agencies, and critical infrastructure globally, particularly in the U.S., U.K., and Asia-Pacific regions. By exploiting commercial 'Airport' proxy services designed to bypass China's Great Firewall, specifically fastlink.ws, the quartermaster enables multiple threat actors to conduct operations while maintaining anonymity through shared infrastructure, representing a significant evolution in state-sponsored cyber operations.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.lumen.com/blog/en-us/the-infrastructure-quartermaster-inside-a-china-nexus-state-enablement-model"]
- Adversary
- null
- Pulse Id
- 6a8f620bb055d185ccef386a
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainqt-team.com | — | |
domainqtproxy.xyz | — | |
domainqt-proxy.org | — | |
domainmq-task.qt-proxy.org | — | |
domainmq-result.qt-proxy.org | — | |
domainwww.qtproxy.xyz | — | |
domaininstantmessagehub.tech | — | |
domainmq-result-qt-team.com | — | |
domainmq-task-qt-team.com | — | |
domainflanycast-hk-bak.yotocloud.com | — | |
domainflanycast-hk.yotocloud.com | — | |
domainflanycast-jp.yotocloud.com | — | |
domainflanycast-sg.yotocloud.com | — | |
domainflanycast-tw.yotocloud.com | — | |
domainflanycast-us-bak.yotocloud.com | — | |
domainflanycast-us.yotocloud.com | — | |
domainflanycast-xxxx.yotocloud.com | — | |
domainflnode-dl.yotocloud.com | — | |
domainflnode-ulus.yotocloud.com | — | |
domainflnode-xxxx.yotocloud.com | — | |
domainjump.qt-proxy.org | — |
Threat ID: 6a90b51eacd9273b49c9fb54
Added to database: 08/27/2026, 22:07:26 UTC
Last updated: 08/28/2026, 03:37:48 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.