Federal authorities disabled two interconnected online hacking platforms on Aug. 26 by seizing domains essential to their communication and authentication functions. According to the Justice Department, the tools—named QScan and QTRouter—were used by state-sponsored hackers to target critical infrastructure and sensitive networks operated by major U.S. agencies.
Court records attribute the platforms to QTFY, a Chinese state-sponsored hacking group employed by Nanjing Xinjiuwei Network Technology Company. An FBI affidavit alleges that QTFY sold hacking services to customers including China’s Ministry of State Security and the People’s Liberation Army. The targeted agencies included NASA, the Federal Reserve, the Energy Department, the Justice Department, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate.
The two platforms performed different functions within an integrated system. QScan contained more than 200 proof-of-concept exploits and processed over 2 million scanning and penetration-testing tasks on a single day in 2024, automatically compromising vulnerable internet-connected devices. Those devices were then added to QTRouter, which combined hijacked hardware with commercial proxy services and leased virtual private servers to disguise the true origins of malicious communications.
The latest action follows several previous court-authorized operations targeting foreign cyber infrastructure, including efforts to remove PlugX surveillance malware and disable Flax Typhoon and Volt Typhoon botnets. Federal authorities have also increasingly collaborated with technology companies to disrupt scam-linked accounts, block malicious traffic, and freeze associated funds.
