US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks

QTFY is a Chinese state-sponsored hacking group operating since 2018 through a company named Nanjing Xinjiuwei Network Technology. It offered hacking services to the Chinese government and others, targeting US military, critical infrastructure, government agencies, telecoms, and educational institutions. The group used QScan to identify vulnerable IoT devices and QTRouter to create a botnet for obfuscation and evasion. The US Justice Department and FBI disrupted QTFY by seizing domains essential for QScan and QTRouter operation, effectively neutralizing the platform. QTFY exploited vulnerabilities in products from multiple vendors including BeyondTrust, Ivanti, Microsoft, Fortinet, and others. The group is involved in exploit development and collaborates with other Chinese cyber espionage entities. The disruption prevents further use of QTFY’s infrastructure but does not address specific software vulnerabilities.

QTFY enabled cyberattacks against US military, critical infrastructure, government, telecoms, and education sectors, with some attacks successful against entities such as NASA, the Justice Department, the Federal Reserve, and others. The disruption of QTFY’s infrastructure by US authorities has halted the operation of their scanning and botnet platforms, preventing further exploitation and obfuscation activities by this threat actor. This reduces the immediate threat posed by QTFY to US critical systems and infrastructure.

The US government’s seizure of domains used by QTFY’s QScan and QTRouter platforms has rendered these tools inoperable, effectively disrupting the threat actor’s capabilities. No direct patch or remediation is applicable since this is an operational disruption of a threat actor’s infrastructure. Organizations should continue to apply vendor patches for vulnerabilities exploited by QTFY as part of standard cybersecurity hygiene. No additional immediate action is required to mitigate this specific disruption event.